[tianxiaochannel-oss88]

This adds one GitHub Actions pipeline for complete macOS arm64 and Windows x64 unsigned development candidates. A build is bound to a full source SHA and matching prerelease versions; both platforms must succeed before an optional manual dispatch can create a new Draft prerelease. The workflow never publishes a Draft, overwrites assets, or repoints an existing tag. It needs no signing certificate, PAT, or model API secret.

The pipeline builds pinned gstack resources on each native host, including the browser and native tools. TestSavant weights download from the fixed official revision on first use, with fixed file sizes and SHA-256 verification before publication into owned application state. Missing, downloading, failed, or invalid model state blocks the scan; inference remains local. Model cache locking handles interrupted writers and bounded Windows sharing contention while retaining owner checks and persistent filesystem errors.

The Windows development lane uses private copies of the stock installer templates with narrow shell/banner changes, preserving installation, registered-path upgrade, rollback, extraction, and uninstall. Final archive checks compare the complete application payload and exact distribution materials. Windows hosted verification additionally exercises custom-path installation, same-version upgrade without a path override, installed Electron startup, shortcut registration, and uninstall cleanup. These checks are separate from end-user GUI, Office, and model-task acceptance.

Release collection and optional Draft creation reject mixed sources/platforms and verify local archives against the package report, then check uploaded asset digests. Notices and source records are bound to actual dependency versions; the historical canvas 0.1.80 dependency-graph limitation remains explicit. Native source/toolchain approvals are static reviewed records rather than build-generated approvals.

Validation is still in progress; this PR remains a Draft:

• Local release/archive/installer/distribution contracts and source/publication regressions passed. The latest model lock regressions pass 25/25, including forced failing-before-repair interleavings and persistent-error cases.
• Complete macOS gstack assembly, official first download, offline cache/inference, HTTP scan states, and packaged Chromium CLI smoke passed. Hosted macOS reproduced the gstack build, Office runtime checks, and version-matched material generation; final packaging is still being exercised.
• Native Windows contracts exposed NTFS contention, now repaired with regression coverage. Fresh Windows build, compiler/import-graph review, final installation lifecycle, and full product CI remain required before landing.
• Secret-scan reports were verified to be SHA-256 source-review lines. The narrow manifest-line exception clears the reports while ordinary credentials inside and outside that file remain detectable.
• Latest candidate run: https://github.com/ling-stack-org/ling-stack/actions/runs/39957257292 (source 8345df120aec65f452628c5a4097a5ac1945f826). No Release or tag is created by these PR test runs.

Operator instructions: docs/release/github-actions.md.