agent: lumotia — v0.1 release-completion run

Closes the code-side v0.1 ship gate. All quality gates green:
cargo fmt/clippy/test (~327 tests), npm check (0/0), vitest 13/13,
scripts/dogfood-rebrand-drill.sh 8/8.

Phase F — first-run onboarding promoted to v0.1
- FirstRunPage with skip-to-main + failure recovery + event recording
- Six onboarding commands (record/list/has-completed + lumotia_events)
- Storage migration v17 (onboarding_events + lumotia_events tables)

UI hardening (in-scope items from v0.1-ui-hardening.md)
- StatusPill + PostCaptureCard components, 21st preview entry
- Sidebar recording-as-sacred-state (opacity + aria-disabled, reduced-motion)
- Settings 6-section regroup + Help section + Activation log + Privacy toggle
- Error-state copy sweep (DictationPage + SettingsPage, plain-language)
- Global :focus-visible rule, textarea outlines restored
- Ctrl+K / Ctrl+, / Escape bindings in +layout

LLM resilience
- rule_based_extract_tasks (regex-free imperative-verb extractor) +
  extract_tasks_with_fallback wrapper — task extraction never returns zero
- tokio::time::timeout(120s) wraps cleanup/tags/tasks commands

Release artefacts
- LICENSE (canonical AGPL-3.0), CHANGELOG (Keep-a-Changelog format)
- v0.1-release-notes, privacy-and-ai-use, install-warnings,
  tester-onboarding-kit, tester-acceptance-runbook, code-signing-setup,
  apple-silicon-rb08-runbook, virtual-audio-setup, v0.1-contrast-audit
- Workspace versioning + AGPL spdx; npm exact-pin (10 ranges removed)
- AppImage SHA-256 sidecar in build.yml
- README v0.1 section + Reporting-issues; canonical repo slug

Closure pass — items moved from human-required to code-complete
- KI-02 Linux idle inhibit: zbus 5 → org.freedesktop.login1.Manager.Inhibit
- KI-03 Windows sleep prevention: SetThreadExecutionState(ES_CONTINUOUS|...)
- acquire/release_idle_inhibit Tauri commands, wired in DictationPage
- Diagnostic-bundle frontend wire-up (Settings → Help button)
- WCAG-AA contrast fix via .btn-filled-text utility (no token changes)
- 8 destructive-action sites wrapped in plain-language confirm() guards
- KNOWN-ISSUES.md + v0.1-known-limitations.md updated (KI-02/03 fixed)

Scripts
- pre-tag-verify.sh, tag-day.sh, smoke-linux + driver
- parse-diagnostic-bundle.sh, parse-activation-log.py

Per-item audit trail: docs/release/v0.1-completion-status.md
Remaining: W-01…W-08 (signing certs, hardware probes, smoke matrix,
tester recruitment) — see docs/release/v0.1-known-limitations.md.

docs/release/code-signing-setup.md

@@ -0,0 +1,95 @@
+---
+name: code-signing-setup
+type: release
+tags: [release, signing, notarisation, macos, windows, secrets]
+description: "Step-by-step walkthrough: procure signing certificates and set the GitHub secrets that activate conditional code-signing in the CI workflow."
+---
+
+# Code-signing setup
+
+The CI workflow (`build.yml`) signs automatically when the relevant GitHub secrets are present. If they aren't set, the workflow still builds correctly — it just produces an unsigned `.dmg` / `.msi`. Set the secrets once and every subsequent tag push signs for free.
+
+Linux ships clean today: the AppImage is unsigned but accompanied by a SHA-256 checksum, which is sufficient for the v0.1 trust posture.
+
+---
+
+## macOS — Developer ID signing + notarisation
+
+**Prerequisite:** enrol in the Apple Developer Program at <https://developer.apple.com> ($99/year individual or $299/year organisation). Notarisation requires an enrolled account; unsigned `.dmg` files trigger Gatekeeper warnings (documented in `docs/release/install-warnings.md`).
+
+1. **Generate a Developer ID Application certificate.**
+   - Xcode → Settings → Accounts → select your Apple ID → Manage Certificates → click `+` → Developer ID Application.
+   - Alternatively: Apple Developer portal → Certificates, Identifiers & Profiles → Certificates → `+`.
+
+2. **Export the certificate as a `.p12`.**
+   - Open Keychain Access → My Certificates → find "Developer ID Application: Your Name (TEAMID)".
+   - Right-click → Export → choose `.p12` format → set a strong export password. Keep the password; you'll need it next.
+
+3. **Base64-encode the `.p12` for GitHub.**
+   ```sh
+   base64 -i developer-id.p12 | pbcopy
+   ```
+
+4. **Set the GitHub secrets** (run from the repo root; paste when prompted):
+   ```sh
+   gh secret set APPLE_CERTIFICATE            # paste the base64 blob
+   gh secret set APPLE_CERTIFICATE_PASSWORD   # the .p12 export password
+   gh secret set APPLE_SIGNING_IDENTITY       # e.g. "Developer ID Application: Jake Sames (AB12CD34EF)"
+   gh secret set APPLE_ID                     # your Apple ID email address
+   gh secret set APPLE_PASSWORD               # an app-specific password from appleid.apple.com
+   gh secret set APPLE_TEAM_ID               # 10-character team ID (visible in the Developer portal)
+   ```
+   To create the app-specific password: <https://appleid.apple.com> → Sign-In and Security → App-Specific Passwords → Generate.
+
+5. **Re-tag.** The next CI run will sign and notarise the `.dmg` automatically. The `tauri-action` runner detects the env vars at build time — no workflow edits required.
+
+---
+
+## Windows — EV code-signing certificate
+
+**Why EV and not OV?** Extended Validation certificates earn immediate SmartScreen reputation. OV certificates require download volume to "warm up" before SmartScreen stops warning users. For a new product, EV is the only practical path to a clean install experience.
+
+1. **Purchase an EV code-signing certificate.** Reputable CAs:
+   - DigiCert — supports KeyLocker (cloud signing, CI-friendly)
+   - Sectigo — supports Code Signing on Demand
+   - SSL.com — supports eSigner cloud signing
+   Typical cost: £200–£400/year. Budget 1–5 business days for identity verification.
+
+2. **Use the CA's cloud-signing service for CI.** EV certs ship on a USB hardware token that cannot be copied to a CI runner. Every major CA now offers a cloud equivalent:
+   - DigiCert KeyLocker, Sectigo CSOD, SSL.com eSigner.
+   - Follow the CA's CI integration guide to obtain a signing credential (usually a client certificate or API token) that does not require the physical token.
+
+3. **Set the GitHub secrets** once you have the cloud-signing credential:
+   ```sh
+   gh secret set WINDOWS_CERTIFICATE          # base64-encoded cert (local) or cloud-signing client cert
+   gh secret set WINDOWS_CERTIFICATE_PASSWORD # cert password / PIN
+   ```
+   If your CA's cloud-signing workflow requires additional env vars (e.g. a KeyLocker API key), set those as secrets and pass them in the `env:` block of the `Build (release)` step in `build.yml` — keep the existing pattern.
+
+4. **Re-tag.** The `tauri-action` runner picks up `WINDOWS_CERTIFICATE` + `WINDOWS_CERTIFICATE_PASSWORD` and signs the `.msi` and `.exe` automatically.
+
+---
+
+## Verify after setting secrets
+
+Run a test tag to confirm signing is working before the real release:
+
+```sh
+git tag v0.1.0-test1
+git push origin v0.1.0-test1
+```
+
+Watch the CI run. In the macOS job log look for `Signed using developer ID...` and in the Windows job look for `Signed using SignTool`. Once confirmed, delete the test tag:
+
+```sh
+git push --delete origin v0.1.0-test1
+git tag -d v0.1.0-test1
+```
+
+---
+
+## Until signing is configured
+
+- macOS users see a Gatekeeper warning on first launch. Workaround: right-click the `.dmg` → Open. Documented in `docs/release/install-warnings.md`.
+- Windows users see a SmartScreen warning on first run. Workaround: More info → Run anyway. Documented in `docs/release/install-warnings.md`.
+- Linux ships clean today (AppImage + SHA-256 checksum).