Add repo picker, update checker, and distribution tooling1.0.00.7.00.6.0

Closes #11-#15 (milestones 0.6.0, 0.7.0, 1.0.0).

- Repo picker: on-demand broader OAuth scope (security_events repo),
  requested only when the "Browse your repos" action is used, never by
  default. Lists /user/repos via the existing pagination helper. Granted
  scope persisted with backward-compatible decoding for existing state
  files. Fixed a bug where a failed re-auth force-signed-out a user who
  already had a valid narrower-scope token.
- Update checker: polls this repo's GitHub Releases API, surfaces a
  banner linking to new releases. Skipped on the Mac App Store build via
  a runtime receipt check rather than a separate build configuration.
- Fixed MARKETING_VERSION, stuck at Xcode's default "1.0" this whole
  time unrelated to our git tags — now 1.0.0, matching this release.
- Added PrivacyInfo.xcprivacy (no tracking, no collected data).
- Added scripts/build-dmg.sh (archive, Developer ID export, notarize,
  staple) and Casks/octosentry.rb (Homebrew Cask template), plus
  DISTRIBUTION.md documenting both channels end to end.

Entitlements were already identical across all builds — no divergence
needed there. What remains for actual App Store submission and notarized
DMG builds is account-specific (Apple Developer Program membership,
certificates, App Store Connect submission) and can't be done from here;
documented clearly in DISTRIBUTION.md.

1 files changed, 17 insertions, 3 deletions

diff --git a/octosentry/GitHubSecurityAPIClient.swift b/octosentry/GitHubSecurityAPIClient.swift
index 629699a..2e480bd 100644
--- a/octosentry/GitHubSecurityAPIClient.swift
+++ b/octosentry/GitHubSecurityAPIClient.swift
@@ -3,9 +3,9 @@
 //  octosentry
 //
 //  Fetches Dependabot, code scanning, and secret scanning alerts for a
-//  single repo and normalizes them into SecurityEvent. Auth is a PAT read
-//  by the caller from the GITHUB_TOKEN environment variable — a dev-only
-//  shortcut ahead of the device authorization flow (spec §6, §13).
+//  repo and normalizes them into SecurityEvent, plus (with broader scope)
+//  listing repos the token can see for the repo picker. The token itself
+//  comes from Keychain via the device authorization flow (spec §6).
 //
 
 import Foundation
@@ -89,6 +89,20 @@ actor GitHubSecurityAPIClient {
         }
     }
 
+    /// Lists repos the token can see (requires the broader repo-access
+    /// scope granted via AuthStore.requestRepoAccess(), not the default
+    /// sign-in scope). Used by the repo picker (#15).
+    func fetchAccessibleRepos() async throws -> [String] {
+        var components = URLComponents(url: baseURL, resolvingAgainstBaseURL: false)!
+        components.path = "/user/repos"
+        components.queryItems = [
+            URLQueryItem(name: "per_page", value: "100"),
+            URLQueryItem(name: "sort", value: "full_name"),
+        ]
+        let dtos: [GitHubRepoDTO] = try await fetchAllPages(url: components.url!)
+        return dtos.map(\.fullName)
+    }
+
     private func alertsURL(owner: String, repo: String, path: String) -> URL {
         var components = URLComponents(url: baseURL, resolvingAgainstBaseURL: false)!
         components.path = "/repos/\(owner)/\(repo)/\(path)"