build(release): stage local macOS v0.1.0 distribution

frontend/scripts/create-desktop-release-provenance.mjs

@@ -17,6 +17,7 @@ const tag = value("--tag") || process.env.GITHUB_REF_NAME;
 const commit = value("--commit") || process.env.GITHUB_SHA;
 const macosSigning = value("--macos-signing");
 const windowsSigning = value("--windows-signing");
+const releaseStage = value("--stage") || "complete";
 const outputPath = resolve(
   frontendDir,
   value("--output") || "src-tauri/target/desktop-release-feed/DESKTOP-RELEASE-PROVENANCE.json",
@@ -31,6 +32,13 @@ assert(tag === `v${packageInfo.version}`, `Release provenance tag must be v${pac
 assert(/^[0-9a-f]{40}$/i.test(commit || ""), "Release provenance commit must be a full 40-character SHA.");
 assert(macosSigning === resolution.macosSigning, `macOS signing mode must be ${resolution.macosSigning}.`);
 assert(windowsSigning === resolution.windowsSigning, `Windows signing mode must be ${resolution.windowsSigning}.`);
+assert(["complete", "macos-first"].includes(releaseStage), "Release provenance stage must be complete or macos-first.");
+if (releaseStage === "macos-first") {
+  assert(
+    resolution.macosLocalExactTagFallback === true && resolution.windowsDelivery === "deferred-same-tag",
+    `v${packageInfo.version} does not approve a staged local macOS-first release.`,
+  );
+}
 
 if (failures.length > 0) {
   throw new Error(`Desktop release provenance creation failed:\n${failures.map((item) => `  - ${item}`).join("\n")}`);
@@ -50,6 +58,13 @@ const provenance = {
   updaterSigning: "required-and-verified",
   artifactLabel: resolution.artifactLabel,
   distribution: resolution.distribution,
+  stage: releaseStage,
+  platformAvailability:
+    releaseStage === "macos-first"
+      ? { macos: "available", windows: "pending-same-tag" }
+      : { macos: "available", windows: "available" },
+  updaterFeedActivation:
+    releaseStage === "macos-first" ? "withheld-pending-combined-verification" : "combined-platform-verification-required",
   warnings: resolution.warningRequired
     ? [
         "macOS is ad-hoc signed and not Apple-notarized; Gatekeeper warnings are expected.",