Add repo picker, update checker, and distribution tooling1.0.00.7.00.6.0

Closes #11-#15 (milestones 0.6.0, 0.7.0, 1.0.0).

- Repo picker: on-demand broader OAuth scope (security_events repo),
  requested only when the "Browse your repos" action is used, never by
  default. Lists /user/repos via the existing pagination helper. Granted
  scope persisted with backward-compatible decoding for existing state
  files. Fixed a bug where a failed re-auth force-signed-out a user who
  already had a valid narrower-scope token.
- Update checker: polls this repo's GitHub Releases API, surfaces a
  banner linking to new releases. Skipped on the Mac App Store build via
  a runtime receipt check rather than a separate build configuration.
- Fixed MARKETING_VERSION, stuck at Xcode's default "1.0" this whole
  time unrelated to our git tags — now 1.0.0, matching this release.
- Added PrivacyInfo.xcprivacy (no tracking, no collected data).
- Added scripts/build-dmg.sh (archive, Developer ID export, notarize,
  staple) and Casks/octosentry.rb (Homebrew Cask template), plus
  DISTRIBUTION.md documenting both channels end to end.

Entitlements were already identical across all builds — no divergence
needed there. What remains for actual App Store submission and notarized
DMG builds is account-specific (Apple Developer Program membership,
certificates, App Store Connect submission) and can't be done from here;
documented clearly in DISTRIBUTION.md.

1 files changed, 36 insertions, 4 deletions

diff --git a/octosentry/PersistedState.swift b/octosentry/PersistedState.swift
index 3ef4234..c8c1bae 100644
--- a/octosentry/PersistedState.swift
+++ b/octosentry/PersistedState.swift
@@ -3,10 +3,12 @@
 //  octosentry
 //
 //  Everything the app remembers across launches: the repo watch list,
-//  local-only seen-state per event, last-fetch timestamp per repo, and the
-//  minimum severity filter. Flat JSON over SwiftData (see #1) — small,
-//  inspectable, and these are already plain Codable values passed across
-//  actor boundaries, not reference types tied to a persistence context.
+//  local-only seen-state per event, last-fetch timestamp per repo, the
+//  minimum severity filter, and whether the current token has the
+//  broader "repo" scope needed to list repos. Flat JSON over SwiftData
+//  (see #1) — small, inspectable, and these are already plain Codable
+//  values passed across actor boundaries, not reference types tied to a
+//  persistence context.
 //
 
 import Foundation
@@ -16,6 +18,36 @@ nonisolated struct PersistedState: Codable {
     var seenEventIDs: Set<String>
     var lastFetchByRepo: [String: Date]
     var minimumSeverity: SecurityEventSeverity
+    var hasRepoScope: Bool
+
+    enum CodingKeys: String, CodingKey {
+        case watchedRepos, seenEventIDs, lastFetchByRepo, minimumSeverity, hasRepoScope
+    }
+
+    init(
+        watchedRepos: [String],
+        seenEventIDs: Set<String>,
+        lastFetchByRepo: [String: Date],
+        minimumSeverity: SecurityEventSeverity,
+        hasRepoScope: Bool = false
+    ) {
+        self.watchedRepos = watchedRepos
+        self.seenEventIDs = seenEventIDs
+        self.lastFetchByRepo = lastFetchByRepo
+        self.minimumSeverity = minimumSeverity
+        self.hasRepoScope = hasRepoScope
+    }
+
+    // Custom decode so existing state.json files saved before hasRepoScope
+    // existed still load instead of falling back to .placeholder.
+    init(from decoder: Decoder) throws {
+        let container = try decoder.container(keyedBy: CodingKeys.self)
+        watchedRepos = try container.decode([String].self, forKey: .watchedRepos)
+        seenEventIDs = try container.decode(Set<String>.self, forKey: .seenEventIDs)
+        lastFetchByRepo = try container.decode([String: Date].self, forKey: .lastFetchByRepo)
+        minimumSeverity = try container.decode(SecurityEventSeverity.self, forKey: .minimumSeverity)
+        hasRepoScope = try container.decodeIfPresent(Bool.self, forKey: .hasRepoScope) ?? false
+    }
 
     static let placeholder = PersistedState(
         watchedRepos: ["ccleberg/cleberg.net"],