build(release): simplify v0.1.0 visible assets

frontend/scripts/desktop-release-policy.mjs

@@ -41,6 +41,18 @@ const validatePolicy = (policy) => {
         exception?.updaterFeedActivation === "after-combined-platform-verification",
         `${prefix} must withhold the production updater feed until both platforms are verified.`,
       );
+      assert(
+        exception?.githubReleaseAssetProfile === "installer-and-checksum-only",
+        `${prefix} must keep the user-facing GitHub Release limited to installers and their checksum manifest.`,
+      );
+      assert(
+        exception?.stagedEvidenceRetention === "private-until-updater-publish",
+        `${prefix} must retain updater artifacts and release evidence privately until updater publication.`,
+      );
+      assert(
+        exception?.updaterArtifactPublishTarget === "anonymous-https-origin",
+        `${prefix} must publish updater artifacts to an anonymous HTTPS origin.`,
+      );
     }
     assert(/^\d{4}-\d{2}-\d{2}$/.test(exception?.approvedOn || ""), `${prefix} must record an approval date.`);
     assert(
@@ -92,6 +104,9 @@ export const resolveDesktopReleasePolicy = (version, policy) => {
     macosLocalExactTagFallback: exception.macosLocalExactTagFallback === true,
     windowsDelivery: exception.windowsDelivery,
     updaterFeedActivation: exception.updaterFeedActivation,
+    githubReleaseAssetProfile: exception.githubReleaseAssetProfile,
+    stagedEvidenceRetention: exception.stagedEvidenceRetention,
+    updaterArtifactPublishTarget: exception.updaterArtifactPublishTarget,
     exception,
   };
 };

frontend/scripts/verify-desktop-release.mjs

@@ -428,7 +428,7 @@ const verifyWorkflowGates = async () => {
   const windowsPendingNotice = await readFile(resolve(frontendDir, "desktop-release-windows-pending.txt"), "utf8");
   assert(
     windowsPendingNotice.includes("same immutable v0.1.0 tag") && windowsPendingNotice.includes("latest.json is intentionally withheld"),
-    "The staged v0.1.0 release must include an explicit Windows-pending and updater-feed notice.",
+    "The staged v0.1.0 private release evidence must include an explicit Windows-pending and updater-feed notice.",
   );
 
   const releasePolicy = await readJson(resolve(frontendDir, "desktop-release-policy.json"));
@@ -446,8 +446,11 @@ const verifyWorkflowGates = async () => {
     assert(
       currentUnsignedException?.macosLocalExactTagFallback === true &&
         currentUnsignedException?.windowsDelivery === "deferred-same-tag" &&
-        currentUnsignedException?.updaterFeedActivation === "after-combined-platform-verification",
-      "The v0.1.0 exception must constrain local macOS staging, deferred Windows delivery, and updater feed activation.",
+        currentUnsignedException?.updaterFeedActivation === "after-combined-platform-verification" &&
+        currentUnsignedException?.githubReleaseAssetProfile === "installer-and-checksum-only" &&
+        currentUnsignedException?.stagedEvidenceRetention === "private-until-updater-publish" &&
+        currentUnsignedException?.updaterArtifactPublishTarget === "anonymous-https-origin",
+      "The v0.1.0 exception must constrain local macOS staging, deferred Windows delivery, visible GitHub assets, private evidence retention, and updater publication.",
     );
   }
   if (currentUnsignedException) {