Sign renderer qualification in public releases

[Augani]

Root cause

Public release verification required a detached renderer-bootstrap signature, but release.sh left the Xcode packaging phase in preview mode and never supplied the pinned Ed25519 signer. Every candidate therefore failed after the expensive archive and engine build.

Fix

• make the existing release entry point provide the narrow receipt signer interface
• bind it to the Sparkle package resolved in the same DerivedData tree and the existing Dory Ed25519 authority
• pass release mode, signer, and bounded timestamps into the Xcode phase
• reject externally injected renderer qualification authority for public builds
• add signer and orchestration regression tests to normal and release workflows

Verification

• shell syntax and diff checks
• release orchestrator tests
• signer adapter tests
• renderer production tuple tests
• candidate workflow tests
• signed the failed candidate receipt with the configured release key and independently verified it against Dory’s pinned public key