ci: adopt artifact-driven SDLC gates

[IchenDEV]

Outcome

Adopt a risk-scaled, artifact-driven SDLC for Utter and make PR/release evidence deterministic.

• Adds machine-validated intent, spec, plan, and verification bundles.
• Runs the artifact contract, repository checks, Swift tests, and a release-style app build behind the stable SDLC Gate.
• Preserves the existing OpenType Signing self-signed release path without an ad-hoc fallback.
• Requires certificate fingerprint matching, full mounted-App comparison, immutable asset round-trip, and checksums.
• Applies Apple notarization, stapling, and Gatekeeper assessment only when the built app uses Developer ID.
• Adds incident feedback, CODEOWNERS, issue/PR templates, review policy, and release controls.

SDLC bundle and risk

• Bundle: docs/sdlc/changes/2026-08-25-ai-native-sdlc/
• Risk: high
• Human decisions still required:
  • activate the main ruleset and require SDLC Gate;
  • configure a required reviewer on the production environment;
  • decide if/when public distribution migrates from project self-signing to Developer ID.

Verification

• GitHub PR run 32871797612 — Contract & Tests, Release-style App Build, and SDLC Gate passed
• python3 scripts/sdlc.py validate --base origin/main — 1 verified bundle covering 37 changed paths
• bash scripts/ci-basic-checks.sh — 13 SDLC tests plus repository checks passed
• DEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer swift test — 564 XCTest tests and 1 Swift Testing test passed; 8 environment-gated tests skipped
• Release-style app build — Xcode/Metal app build, arm64 app/helper, hardened-runtime ad-hoc signature, and artifact checks passed locally and on GitHub
• Current GitHub v0.0.43 self-signed DMG — Authority=OpenType Signing, no Apple team identifier, certificate SHA-256 match, full mounted-bundle comparison, and DMG verification passed
• Release workflow YAML and every shell run block parsed
• Independent high-risk review — final result: no actionable findings
• Real-window light/dark and narrow-width QA — not applicable; no product UI changed
• Privacy, permission, external-service, and failure paths — missing identities fail closed; ad-hoc apps fail self-signed verification; Developer ID notarization remains pending a protected live run

Residual risk and rollback

• The PR workflow is green; the tag-triggered Release workflow has not been live-executed with the new dual-signing logic.
• main and production are not currently protected by required review.
• The retained self-signed release is not Apple-notarized and may require manual macOS approval; the workflow adds an explicit release warning.
• Developer ID credentials and the notarization path are not configured or live-verified.
• GitHub reports a non-blocking Node 20 deprecation annotation for actions/checkout@v4.
• Roll back by reverting this commit. Do not replace an already published same-version release or weaken a failing gate inline.

Reviewer focus

Please focus on:

1. self-signed versus Developer ID classification and certificate fingerprint binding;
2. complete equality between the built app and the app mounted from the DMG;
3. direct-push/PR diff coverage and minimum risk mapping;
4. draft upload, checksum round-trip, and immutable release publication;
5. the documented boundary between repository controls and GitHub settings that remain external.