Add repo picker, update checker, and distribution tooling1.0.00.7.00.6.0

Closes #11-#15 (milestones 0.6.0, 0.7.0, 1.0.0).

- Repo picker: on-demand broader OAuth scope (security_events repo),
  requested only when the "Browse your repos" action is used, never by
  default. Lists /user/repos via the existing pagination helper. Granted
  scope persisted with backward-compatible decoding for existing state
  files. Fixed a bug where a failed re-auth force-signed-out a user who
  already had a valid narrower-scope token.
- Update checker: polls this repo's GitHub Releases API, surfaces a
  banner linking to new releases. Skipped on the Mac App Store build via
  a runtime receipt check rather than a separate build configuration.
- Fixed MARKETING_VERSION, stuck at Xcode's default "1.0" this whole
  time unrelated to our git tags — now 1.0.0, matching this release.
- Added PrivacyInfo.xcprivacy (no tracking, no collected data).
- Added scripts/build-dmg.sh (archive, Developer ID export, notarize,
  staple) and Casks/octosentry.rb (Homebrew Cask template), plus
  DISTRIBUTION.md documenting both channels end to end.

Entitlements were already identical across all builds — no divergence
needed there. What remains for actual App Store submission and notarized
DMG builds is account-specific (Apple Developer Program membership,
certificates, App Store Connect submission) and can't be done from here;
documented clearly in DISTRIBUTION.md.

1 files changed, 27 insertions, 0 deletions

diff --git a/Casks/octosentry.rb b/Casks/octosentry.rb
new file mode 100644
index 0000000..becc4fd
--- /dev/null
+++ b/Casks/octosentry.rb
@@ -0,0 +1,27 @@
+# Homebrew Cask for octosentry (spec §9: DMG/Homebrew distribution channel).
+#
+# This file lives here as a template — Homebrew taps must be their own repo
+# named "homebrew-<tapname>" for `brew tap` to find them. To actually publish:
+#   1. Create github.com/zerolabsco/homebrew-tap (or similar)
+#   2. Copy this file there as Casks/octosentry.rb
+#   3. Fill in sha256 below with the real checksum of the released DMG:
+#        shasum -a 256 octosentry-<version>.dmg
+#   4. Users install via: brew tap zerolabsco/tap && brew install --cask octosentry
+
+cask "octosentry" do
+  version "1.0.0"
+  sha256 "REPLACE_WITH_REAL_SHA256_OF_RELEASED_DMG"
+
+  url "https://github.com/zerolabsco/octosentry/releases/download/#{version}/octosentry-#{version}.dmg"
+  name "octosentry"
+  desc "Menu bar app aggregating GitHub security alerts into one feed"
+  homepage "https://github.com/zerolabsco/octosentry"
+
+  depends_on macos: ">= :sonoma"
+
+  app "octosentry.app"
+
+  zap trash: [
+    "~/Library/Application Support/octosentry",
+  ]
+end