build(release): simplify v0.1.0 visible assets

frontend/desktop-release-policy.json

@@ -12,6 +12,9 @@
       "macosLocalExactTagFallback": true,
       "windowsDelivery": "deferred-same-tag",
       "updaterFeedActivation": "after-combined-platform-verification",
+      "githubReleaseAssetProfile": "installer-and-checksum-only",
+      "stagedEvidenceRetention": "private-until-updater-publish",
+      "updaterArtifactPublishTarget": "anonymous-https-origin",
       "approvedOn": "2026-07-17",
       "reason": "The v0.1.0 release owner cannot currently provide Apple Developer signing/notarization credentials or an organization Windows code-signing certificate, and hosted Windows build capacity is temporarily unavailable."
     }

frontend/scripts/desktop-release-policy.mjs

@@ -41,6 +41,18 @@ const validatePolicy = (policy) => {
         exception?.updaterFeedActivation === "after-combined-platform-verification",
         `${prefix} must withhold the production updater feed until both platforms are verified.`,
       );
+      assert(
+        exception?.githubReleaseAssetProfile === "installer-and-checksum-only",
+        `${prefix} must keep the user-facing GitHub Release limited to installers and their checksum manifest.`,
+      );
+      assert(
+        exception?.stagedEvidenceRetention === "private-until-updater-publish",
+        `${prefix} must retain updater artifacts and release evidence privately until updater publication.`,
+      );
+      assert(
+        exception?.updaterArtifactPublishTarget === "anonymous-https-origin",
+        `${prefix} must publish updater artifacts to an anonymous HTTPS origin.`,
+      );
     }
     assert(/^\d{4}-\d{2}-\d{2}$/.test(exception?.approvedOn || ""), `${prefix} must record an approval date.`);
     assert(
@@ -92,6 +104,9 @@ export const resolveDesktopReleasePolicy = (version, policy) => {
     macosLocalExactTagFallback: exception.macosLocalExactTagFallback === true,
     windowsDelivery: exception.windowsDelivery,
     updaterFeedActivation: exception.updaterFeedActivation,
+    githubReleaseAssetProfile: exception.githubReleaseAssetProfile,
+    stagedEvidenceRetention: exception.stagedEvidenceRetention,
+    updaterArtifactPublishTarget: exception.updaterArtifactPublishTarget,
     exception,
   };
 };

frontend/scripts/verify-desktop-release.mjs

@@ -428,7 +428,7 @@ const verifyWorkflowGates = async () => {
   const windowsPendingNotice = await readFile(resolve(frontendDir, "desktop-release-windows-pending.txt"), "utf8");
   assert(
     windowsPendingNotice.includes("same immutable v0.1.0 tag") && windowsPendingNotice.includes("latest.json is intentionally withheld"),
-    "The staged v0.1.0 release must include an explicit Windows-pending and updater-feed notice.",
+    "The staged v0.1.0 private release evidence must include an explicit Windows-pending and updater-feed notice.",
   );
 
   const releasePolicy = await readJson(resolve(frontendDir, "desktop-release-policy.json"));
@@ -446,8 +446,11 @@ const verifyWorkflowGates = async () => {
     assert(
       currentUnsignedException?.macosLocalExactTagFallback === true &&
         currentUnsignedException?.windowsDelivery === "deferred-same-tag" &&
-        currentUnsignedException?.updaterFeedActivation === "after-combined-platform-verification",
-      "The v0.1.0 exception must constrain local macOS staging, deferred Windows delivery, and updater feed activation.",
+        currentUnsignedException?.updaterFeedActivation === "after-combined-platform-verification" &&
+        currentUnsignedException?.githubReleaseAssetProfile === "installer-and-checksum-only" &&
+        currentUnsignedException?.stagedEvidenceRetention === "private-until-updater-publish" &&
+        currentUnsignedException?.updaterArtifactPublishTarget === "anonymous-https-origin",
+      "The v0.1.0 exception must constrain local macOS staging, deferred Windows delivery, visible GitHub assets, private evidence retention, and updater publication.",
     );
   }
   if (currentUnsignedException) {