[mitchelljphayes]

Summary

Lands the v0.1.0 candidate for source distribution and the Homebrew
source-build Formula. The previous commit be8c333 (daemon hardening,
installers, Raycast ext, CI) is already on main; this PR layers the
wake-from-sleep recovery, source/Homebrew packaging, and Raycast
identity/dep updates on top.

What this PR adds

• Wake-from-sleep recovery (src/wake.rs, src/main.rs,
  src/macos_ffi.rs, src/hidutil.rs): IOKit IORegisterForSystemPower
  watcher with a ~2 s debounced one-shot timer (CFRunLoopTimer) that
  re-applies Switcheroo's owned modifier remaps through the existing
  idempotent hidutil path. All live hidutil transactions are serialized
  through HIDUTIL_TRANSACTION_LOCK; the panic hook uses try_lock
  and falls back to the durable state file when the lock is held or
  poisoned. extern "C" trampolines catch panics. PowerWatcher
  cleanup follows Apple QA1340's deterministic Drop order.

• Source + Homebrew packaging (scripts/package.sh,
  scripts/version-sync.sh, packaging/homebrew/,
  rust-toolchain.toml, bundle/AppIcon-1024.png, install.sh):
  deterministic source/binary archive builder with isolated
  CARGO_TARGET_DIR, fresh-private mktemp output, hermetic
  release-mode env -i build with private HOME/CARGO_HOME and
  --frozen, source/binary byte-identity reproducibility check,
  deterministic manifest bound to the validated commit SHA. Homebrew
  Formula template builds from source via cargo install *std_cargo_args; render_formula.sh builds the production
  Formula from strict-semver version + 64-hex SHA-256 (URL
  constructed internally) with a rehearsal-mode safe-copy path and
  DO NOT PUBLISH marker. rust-toolchain.toml pins rustc 1.95.0.

• CI hardening (.github/workflows/ci.yml,
  .github/workflows/release.yml): macos-14-pinned runners,
  full-SHA-pinned actions, persist-credentials: false,
  --locked clippy/test/build-all-targets/build-all-features gates,
  SHA-pinned cargo-deny advisories check, shellcheck + npm audit +
  raycast lint:ci (eslint + prettier). release.yml is a
  read-only tagged-release artifact pipeline (contents: read only)
  gated on dispatch-from-main, validated semver tag with main-ancestor
  commit, version surfaces verified at the validated SHA, and
  scripts/package.sh release mode invoked with the validated commit
  SHA. private-validation-artifacts upload only — no GitHub
  Release is created.

• Raycast extension (raycast-extension/): lint:ci script
  added (eslint + prettier), service.ts / service-pure.mjs /
  service.test.mjs split for testable pure helpers with full Homebrew
  identity validation, exact executable matching against the two
  official opt_prefix paths, pre-kickstart re-verification, and 22
  service unit tests.

• Documentation (README.md, CHANGELOG.md, RELEASING.md):
  Homebrew source-build is now Option 0 (recommended public path);
  binary archive Option A demoted with explicit nonpublic-distribution
  warnings. CHANGELOG.md has the 0.1.0 entry (Added / Security /
  Known Limitations). RELEASING.md is the maintainer release runbook
  (version bump, gates, Homebrew rehearsal, GitHub Actions release
  workflow, publication allowlist, later authorized actions, known
  gaps).

Test gates (carried forward, focused re-verification 2026-09-06)

Gate	Result
cargo fmt --check	✅
cargo clippy --locked --all-targets --all-features -- -D warnings	✅ 0 warn / 0 err
cargo test --locked	✅ 126 / 126
cargo build --locked --all-targets --all-features	✅
shellcheck (lib, test_lib, package, version-sync, install, install-binary, uninstall, render_formula)	✅ 0
scripts/test_lib.sh	✅ 24 / 24
scripts/version-sync.sh	✅ 4 / 0
actionlint	✅ 0
zizmor .	✅ 0 (11 suppressions)
package.sh dry-run + full rehearsal + --verify-reproducibility byte-identity	✅
Raycast eslint + prettier + tsc --noEmit + npm run build + node --test	✅ 22 / 22
Raycast npm audit	✅ 0 vuln
Workflow SHA pins (all uses:)	✅ 34 pinned
Workflow permissions (contents: read only)	✅

Distribution policy (explicit, per RELEASING.md)

• No public binary distribution. Prebuilt archives are produced by
  CI for validation only — they are unnotarized, ad-hoc-signed
  (self-consistency only, NOT authenticity), and must NOT be
  attached to a public GitHub Release. Co-hosted checksums provide
  integrity only, not authenticity. The sole public install path is
  the Homebrew source-build Formula.
• No Raycast Store publication in this pass — the Raycast
  extension package.json prepublishOnly deliberately fails; no
  publish script exists.
• Actual v0.1.0 tag and Formula checksum are NOT created in this
  PR. They require the authorized post-merge step (compute the
  SHA-256 of the public tag archive bytes, render
  packaging/homebrew/switcheroo.rb via
  packaging/homebrew/render_formula.sh, create the
  mitchelljphayes/homebrew-switcheroo tap, push
  Formula/switcheroo.rb).

Manual verification notes

• The wake-recovery path is user-reported to work (manual
  verification on the maintainer's machine after sleep/wake cycles),
  but the current daemon install/version was not independently
  verified end-to-end by this PR's author on a fresh account. The
  IOKit lifecycle follows Apple QA1340 and the unit tests cover the
  policy/transaction/rollback edges, but a real-world
  install → sleep → wake → shutdown cycle on a clean account is
  recommended before tagging.
• The Raycast Store publication / ray lint author check is external
  and not in scope; the repo-controlled quality gates
  (lint:ci = eslint + prettier, tsc, build,
  node --test, audit) all pass on the committed code.

Out of scope / follow-ups

• RELEASE_SETUP.md prerequisites (release environment, env-scoped
  sentinel secret, branch protection, immutable v* tag ruleset,
  Actions SHA-pin policy, credential incident resolution) are external
  governance actions — not code changes — and remain out of scope for
  this PR.
• Notarized binary publication / signed manifest + attestation
  deferred (prebuilt binary remains CI-only).
• Keyboard hot-plug (IOServiceAddMatchingNotification) is
  deferred; the ReapplyPolicy / reapply_remappings seam is
  reusable for a future DeviceTrigger.

Reviews / security

• Session code review (review.md): PASS for v0.1.0 source
  release + Homebrew source formula. Zero code-level release blockers.
• Session security audit (security-review.md): no Critical / High /
  Medium code-level blockers for commit, push, PR. Prior High cleanup
  hazard verified fixed. All public-distribution surfaces are
  fail-closed.

Files

34 files changed, 4836 insertions(+), 298 deletions(-) in the new
commit 25ad011 on top of be8c333. .githooks/pre-commit,
.githooks/post-checkout, and .githooks/pre-commit-user (GitButler
state) are intentionally NOT included in this PR.