Provision Sparkle tools in Lume runners

[jmcte]

Summary

• Provision checksum-pinned Sparkle 2.9.4 generate_appcast and generate_keys in the sealed Lume macOS base VM.
• Mark rebuilt Lume slots with the explicit sparkle-release capability and update the base-image metadata.
• Document the base-VM rebuild sequence without placing signing or notarization credentials in the image.

Governing Issue

Closes #178

Validation

• bash -n scripts/guest/install-sparkle-tools.sh
• bash -n scripts/lume/provision-base-vm.sh
• Verified the installer end-to-end against the checksum-verified official Sparkle 2.9.4 archive in a disposable home directory.
• pnpm test (48 files, 273 tests)
• pnpm lint

Bootstrap Governance

• Changes are scoped to the linked issue.
• No real secrets, runtime auth, or machine-local env files are committed.
• The downstream APW workflow will consume a sparkle-release capability only after the base VM is rebuilt and slots are reconciled.

Risk and rollout

• Requires a controlled Lume base-VM reprovision, pool drain, and slot reconciliation before dependent workflows can use the label.
• The runner-group access change for OMT-Global/apw-cli remains an organization-admin action.
• Private Sparkle EdDSA and Apple credentials remain release-time secrets and are intentionally excluded from the base VM.

Merge Automation

• Enable auto-merge once required review and checks are satisfied.

[athena-omt]

Reviewed the Lume Sparkle tooling provisioner. The base-VM path installs only the checksum-pinned public Sparkle release tools, verifies the extracted binaries, updates the pool image tag/label only for rebuilt capacity, and documents that signing/notarization secrets stay out of the VM image.

Validation run on the refreshed PR head:

• pnpm vitest run test/lume-config.test.ts test/lume-scripts.test.ts
• bash -n scripts/guest/install-sparkle-tools.sh scripts/lume/provision-base-vm.sh
• pnpm lint