Add repo picker, update checker, and distribution tooling1.0.00.7.00.6.0

Closes #11-#15 (milestones 0.6.0, 0.7.0, 1.0.0).

- Repo picker: on-demand broader OAuth scope (security_events repo),
  requested only when the "Browse your repos" action is used, never by
  default. Lists /user/repos via the existing pagination helper. Granted
  scope persisted with backward-compatible decoding for existing state
  files. Fixed a bug where a failed re-auth force-signed-out a user who
  already had a valid narrower-scope token.
- Update checker: polls this repo's GitHub Releases API, surfaces a
  banner linking to new releases. Skipped on the Mac App Store build via
  a runtime receipt check rather than a separate build configuration.
- Fixed MARKETING_VERSION, stuck at Xcode's default "1.0" this whole
  time unrelated to our git tags — now 1.0.0, matching this release.
- Added PrivacyInfo.xcprivacy (no tracking, no collected data).
- Added scripts/build-dmg.sh (archive, Developer ID export, notarize,
  staple) and Casks/octosentry.rb (Homebrew Cask template), plus
  DISTRIBUTION.md documenting both channels end to end.

Entitlements were already identical across all builds — no divergence
needed there. What remains for actual App Store submission and notarized
DMG builds is account-specific (Apple Developer Program membership,
certificates, App Store Connect submission) and can't be done from here;
documented clearly in DISTRIBUTION.md.

1 files changed, 9 insertions, 5 deletions

diff --git a/octosentry/GitHubDeviceAuthClient.swift b/octosentry/GitHubDeviceAuthClient.swift
index 63799ff..3105733 100644
--- a/octosentry/GitHubDeviceAuthClient.swift
+++ b/octosentry/GitHubDeviceAuthClient.swift
@@ -15,10 +15,14 @@ actor GitHubDeviceAuthClient {
     // Not a secret — safe to embed in source.
     private let clientID = "Ov23li6tqaTghDc4IJYv"
 
-    // Grants Dependabot/code scanning/secret scanning alert access. Classic OAuth
-    // scopes have no read-only variant (unlike fine-grained PATs); this is the
-    // narrowest scope GitHub offers for these three endpoints via OAuth Apps.
-    private let scope = "security_events"
+    // Default sign-in scope: grants Dependabot/code scanning/secret scanning alert
+    // access. Classic OAuth scopes have no read-only variant (unlike fine-grained
+    // PATs); this is the narrowest scope GitHub offers for these three endpoints.
+    static let defaultScope = "security_events"
+
+    // Broader scope requested only on demand (repo picker, #15) — never the
+    // default, since it's a real increase in blast radius over defaultScope alone.
+    static let repoAccessScope = "security_events repo"
 
     private let session: URLSession
 
@@ -26,7 +30,7 @@ actor GitHubDeviceAuthClient {
         self.session = session
     }
 
-    func requestDeviceCode() async throws -> DeviceCodeResponse {
+    func requestDeviceCode(scope: String) async throws -> DeviceCodeResponse {
         let data = try await post(
             url: URL(string: "https://github.com/login/device/code")!,
             parameters: ["client_id": clientID, "scope": scope]