Add repo picker, update checker, and distribution tooling1.0.00.7.00.6.0

Closes #11-#15 (milestones 0.6.0, 0.7.0, 1.0.0).

- Repo picker: on-demand broader OAuth scope (security_events repo),
  requested only when the "Browse your repos" action is used, never by
  default. Lists /user/repos via the existing pagination helper. Granted
  scope persisted with backward-compatible decoding for existing state
  files. Fixed a bug where a failed re-auth force-signed-out a user who
  already had a valid narrower-scope token.
- Update checker: polls this repo's GitHub Releases API, surfaces a
  banner linking to new releases. Skipped on the Mac App Store build via
  a runtime receipt check rather than a separate build configuration.
- Fixed MARKETING_VERSION, stuck at Xcode's default "1.0" this whole
  time unrelated to our git tags — now 1.0.0, matching this release.
- Added PrivacyInfo.xcprivacy (no tracking, no collected data).
- Added scripts/build-dmg.sh (archive, Developer ID export, notarize,
  staple) and Casks/octosentry.rb (Homebrew Cask template), plus
  DISTRIBUTION.md documenting both channels end to end.

Entitlements were already identical across all builds — no divergence
needed there. What remains for actual App Store submission and notarized
DMG builds is account-specific (Apple Developer Program membership,
certificates, App Store Connect submission) and can't be done from here;
documented clearly in DISTRIBUTION.md.

1 files changed, 41 insertions, 9 deletions

diff --git a/octosentry/AuthStore.swift b/octosentry/AuthStore.swift
index 4386e38..4194bba 100644
--- a/octosentry/AuthStore.swift
+++ b/octosentry/AuthStore.swift
@@ -6,6 +6,11 @@
 //  currently in the Keychain. Replaces the GITHUB_TOKEN env var dev
 //  shortcut (spec §13) with the real v1 auth flow (spec §6).
 //
+//  Sign-in requests the minimal security_events scope by default.
+//  Broader "repo" scope (needed to list repos for the picker, #15) is
+//  only ever requested on demand via requestRepoAccess(), never by
+//  default — a deliberate choice to keep the default blast radius small.
+//
 
 import Foundation
 import Observation
@@ -14,12 +19,17 @@ import Observation
 final class AuthStore {
     private(set) var state: AuthState
     private(set) var errorMessage: String?
+    private(set) var hasRepoAccess = false
 
     private let client = GitHubDeviceAuthClient()
+    private let persistenceStore = PersistenceStore()
     private var authorizationTask: Task<Void, Never>?
 
     init() {
         state = KeychainTokenStore.load() != nil ? .signedIn : .signedOut
+        Task {
+            hasRepoAccess = await persistenceStore.load().hasRepoScope
+        }
     }
 
     var isSignedIn: Bool {
@@ -28,13 +38,32 @@ final class AuthStore {
     }
 
     func signIn() {
+        beginAuthorization(scope: GitHubDeviceAuthClient.defaultScope)
+    }
+
+    /// Re-runs device auth with broader scope so the repo picker can list
+    /// repos. Only called explicitly from the repo picker UI, never on
+    /// the default sign-in path.
+    func requestRepoAccess() {
+        beginAuthorization(scope: GitHubDeviceAuthClient.repoAccessScope)
+    }
+
+    func signOut() {
+        authorizationTask?.cancel()
+        authorizationTask = nil
+        KeychainTokenStore.delete()
+        state = .signedOut
+        hasRepoAccess = false
+    }
+
+    private func beginAuthorization(scope: String) {
         guard authorizationTask == nil else { return }
         errorMessage = nil
 
         authorizationTask = Task {
             defer { authorizationTask = nil }
             do {
-                let deviceCode = try await client.requestDeviceCode()
+                let deviceCode = try await client.requestDeviceCode(scope: scope)
                 state = .awaitingAuthorization(userCode: deviceCode.userCode, verificationURL: deviceCode.verificationUri)
 
                 let token = try await client.pollForToken(
@@ -43,18 +72,21 @@ final class AuthStore {
                     expiresIn: deviceCode.expiresIn
                 )
                 try KeychainTokenStore.save(token)
+
+                let grantedRepoScope = scope.contains("repo")
+                var persisted = await persistenceStore.load()
+                persisted.hasRepoScope = grantedRepoScope
+                await persistenceStore.save(persisted)
+                hasRepoAccess = grantedRepoScope
+
                 state = .signedIn
             } catch {
                 errorMessage = (error as? LocalizedError)?.errorDescription ?? error.localizedDescription
-                state = .signedOut
+                // A failed re-auth (e.g. requestRepoAccess while already
+                // signed in) shouldn't sign the user out of their existing
+                // valid token — only reflect reality from the Keychain.
+                state = KeychainTokenStore.load() != nil ? .signedIn : .signedOut
             }
         }
     }
-
-    func signOut() {
-        authorizationTask?.cancel()
-        authorizationTask = nil
-        KeychainTokenStore.delete()
-        state = .signedOut
-    }
 }