[Zburgers]

What changed

The v1.2.5 release failed because release-on-merge pushed the version commit and immutable tag before dispatching Release Build. PR validation ran against v1.2.4, so the hardcoded v1.2.4 fixture passed there; the later tag validation ran against v1.2.5 and failed. The tag therefore existed even though no GitHub Release was published.

This makes the release flow synchronous and gates the source commit/tag on the actual candidate:

• Simulate the release version and run frontend, Rust, integrity, type, and build checks against the exact candidate tree.
• Build Linux, Windows, and macOS bundles before tagging; validate the release notes and signed updater manifest before promotion.
• Compare the candidate tree and main SHA again before an atomic main-plus-tag push. A failed check, bundle, or concurrent main update leaves no new tag.
• Publish the already validated artifacts after promotion; the release workflow run now reports completion or failure directly.
• Pin every external action to a full commit SHA, retain pnpm/Rust caches, use read-only permissions by default, and expose write permission only to source promotion and release publication.

Verification

• actionlint .github/workflows/*.yml
• node --test tests/release-integrity.test.mjs (8 passing)
• pnpm test (121 passing)
• pnpm typecheck
• pnpm build
• Simulated a v1.2.6 bump and reran release-integrity tests against the bumped files.