[codex] Harden release provenance and login rollback

[ygsgdbd]

Summary

This change hardens release provenance and makes LaunchAgent fallback updates recoverable when installation fails.

The release workflow previously allowed a manually dispatched run to publish an existing tag while the checked-out source still came from the dispatch branch. That could attach an artifact, Sparkle metadata, and a valid GitHub Artifact Attestation to a release tag whose commit did not produce the binary. Manual retries also needed an explicit path that GitHub's branch-only web UI could not provide.

The LaunchAgent fallback installer staged a new plist before committing it, but a failed replacement could delete the previously working plist. A transient filesystem or launchctl failure could therefore turn an existing launch-at-login setup into a disabled one.

Changes

• Resolve lightweight and annotated release tags to their commit and require the triggering ref, event SHA, requested tag, and checked-out HEAD to match before building.
• Require new manual release runs to be dispatched from the target tag through GitHub CLI or API, with copyable commands documented in English and Simplified Chinese.
• Keep the artifact attestation tied to the validated tag source and document verification using the signer workflow, source ref, and source digest.
• Snapshot an existing LaunchAgent plist before staging an update.
• Restore the original plist and re-bootstrap it when staging bootstrap or final commit fails; remove partial output only for first-time installations.
• Add rollback tests covering failed bootstrap, failed replacement, preservation of complete plist contents, and recovery bootstrap failure.

User impact

Release artifacts can no longer be silently built from a branch and published under a different tag. Operators receive an early, actionable failure when the dispatch ref is wrong and can verify the final artifact against the exact tag provenance.

Users with an existing fallback login item no longer lose that configuration when an attempted update fails. The previous plist remains available for the next login even if immediate recovery bootstrap also fails.

Validation

• rtk just check
• git diff --check
• actionlint .github/workflows/release.yml (only the pre-existing SC2129 style warning and softprops/action-gh-release@v1 runner warning remain)
• Verified gh workflow run --ref accepts a branch or tag and -f supplies the release_tag input
• Reviewed staged, unstaged, and untracked changes; no additional actionable findings remained

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.