Add repo picker, update checker, and distribution tooling1.0.00.7.00.6.0

Closes #11-#15 (milestones 0.6.0, 0.7.0, 1.0.0).

- Repo picker: on-demand broader OAuth scope (security_events repo),
  requested only when the "Browse your repos" action is used, never by
  default. Lists /user/repos via the existing pagination helper. Granted
  scope persisted with backward-compatible decoding for existing state
  files. Fixed a bug where a failed re-auth force-signed-out a user who
  already had a valid narrower-scope token.
- Update checker: polls this repo's GitHub Releases API, surfaces a
  banner linking to new releases. Skipped on the Mac App Store build via
  a runtime receipt check rather than a separate build configuration.
- Fixed MARKETING_VERSION, stuck at Xcode's default "1.0" this whole
  time unrelated to our git tags — now 1.0.0, matching this release.
- Added PrivacyInfo.xcprivacy (no tracking, no collected data).
- Added scripts/build-dmg.sh (archive, Developer ID export, notarize,
  staple) and Casks/octosentry.rb (Homebrew Cask template), plus
  DISTRIBUTION.md documenting both channels end to end.

Entitlements were already identical across all builds — no divergence
needed there. What remains for actual App Store submission and notarized
DMG builds is account-specific (Apple Developer Program membership,
certificates, App Store Connect submission) and can't be done from here;
documented clearly in DISTRIBUTION.md.

1 files changed, 63 insertions, 0 deletions

diff --git a/DISTRIBUTION.md b/DISTRIBUTION.md
new file mode 100644
index 0000000..f81fb21
--- /dev/null
+++ b/DISTRIBUTION.md
@@ -0,0 +1,63 @@
+# Distribution
+
+octosentry ships on two channels with a single codebase and identical
+entitlements (spec §9) — the only divergence is signing method at export
+time and whether the update checker runs.
+
+## App Store
+
+1. Requires an active Apple Developer Program membership and an **Apple
+   Distribution** certificate (Xcode > Settings > Accounts > Manage
+   Certificates).
+2. Create the app record in [App Store Connect](https://appstoreconnect.apple.com)
+   with bundle ID `net.cleberg.octosentry`.
+3. Archive: Product > Archive in Xcode (Release configuration).
+4. In the Organizer, Distribute App > App Store Connect > Upload.
+5. Complete the app listing (screenshots, description, privacy nutrition
+   label — [PrivacyInfo.xcprivacy](octosentry/PrivacyInfo.xcprivacy) already
+   declares no tracking and no collected data) and submit for review.
+
+The update checker (`UpdateStore`) detects the App Store receipt at
+runtime and never runs on this build — no code changes needed per release.
+
+## DMG (direct distribution)
+
+Requires a **Developer ID Application** certificate and notarization
+credentials stored once locally:
+
+```bash
+xcrun notarytool store-credentials "octosentry-notary" \
+  --apple-id "[email protected]" \
+  --team-id "YOUR_TEAM_ID" \
+  --password "an-app-specific-password"
+```
+
+(App-specific password from [appleid.apple.com](https://appleid.apple.com),
+not your main Apple ID password.)
+
+Then, per release:
+
+```bash
+scripts/build-dmg.sh 1.0.0
+```
+
+This archives, exports with Developer ID signing, notarizes, staples the
+ticket, and produces `build/octosentry-1.0.0.dmg`. Attach that file to
+the corresponding GitHub Release (`gh release create 1.0.0 build/octosentry-1.0.0.dmg`)
+— the update checker links there.
+
+## Homebrew
+
+Not published yet. [Casks/octosentry.rb](Casks/octosentry.rb) is a
+template — to actually publish it:
+
+1. Create a `zerolabsco/homebrew-tap` repo.
+2. Copy the cask there, filling in the real `sha256` of the released DMG
+   (`shasum -a 256 octosentry-1.0.0.dmg`).
+3. Users install via `brew tap zerolabsco/tap && brew install --cask octosentry`.
+
+## Version bumps
+
+`MARKETING_VERSION` in the Xcode project must match the git tag for each
+release — the update checker compares `CFBundleShortVersionString`
+against the latest GitHub Release's tag name.