Add repo picker, update checker, and distribution tooling1.0.00.7.00.6.0

Closes #11-#15 (milestones 0.6.0, 0.7.0, 1.0.0).

- Repo picker: on-demand broader OAuth scope (security_events repo),
  requested only when the "Browse your repos" action is used, never by
  default. Lists /user/repos via the existing pagination helper. Granted
  scope persisted with backward-compatible decoding for existing state
  files. Fixed a bug where a failed re-auth force-signed-out a user who
  already had a valid narrower-scope token.
- Update checker: polls this repo's GitHub Releases API, surfaces a
  banner linking to new releases. Skipped on the Mac App Store build via
  a runtime receipt check rather than a separate build configuration.
- Fixed MARKETING_VERSION, stuck at Xcode's default "1.0" this whole
  time unrelated to our git tags — now 1.0.0, matching this release.
- Added PrivacyInfo.xcprivacy (no tracking, no collected data).
- Added scripts/build-dmg.sh (archive, Developer ID export, notarize,
  staple) and Casks/octosentry.rb (Homebrew Cask template), plus
  DISTRIBUTION.md documenting both channels end to end.

Entitlements were already identical across all builds — no divergence
needed there. What remains for actual App Store submission and notarized
DMG builds is account-specific (Apple Developer Program membership,
certificates, App Store Connect submission) and can't be done from here;
documented clearly in DISTRIBUTION.md.

1 files changed, 55 insertions, 0 deletions

diff --git a/octosentry/UpdateStore.swift b/octosentry/UpdateStore.swift
new file mode 100644
index 0000000..1ed463f
--- /dev/null
+++ b/octosentry/UpdateStore.swift
@@ -0,0 +1,55 @@
+//
+//  UpdateStore.swift
+//  octosentry
+//
+
+import Foundation
+import Observation
+
+@Observable
+final class UpdateStore {
+    private(set) var availableRelease: UpdateChecker.LatestRelease?
+
+    private let checker = UpdateChecker()
+
+    /// True for a Mac App Store build (has an App Store receipt), false for
+    /// a direct DMG/Homebrew build. Runtime check rather than a build flag —
+    /// see UpdateChecker.swift for why.
+    var isMacAppStoreBuild: Bool {
+        guard let receiptURL = Bundle.main.appStoreReceiptURL else { return false }
+        return FileManager.default.fileExists(atPath: receiptURL.path)
+    }
+
+    func checkForUpdate() async {
+        guard !isMacAppStoreBuild else { return }
+        guard let currentVersion = Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String else { return }
+        guard let latest = try? await checker.fetchLatestRelease() else { return }
+
+        if Self.isNewer(latest.version, than: currentVersion) {
+            availableRelease = latest
+        }
+    }
+
+    static func isNewer(_ candidate: String, than current: String) -> Bool {
+        let candidateParts = versionComponents(candidate)
+        let currentParts = versionComponents(current)
+        let count = max(candidateParts.count, currentParts.count)
+
+        for i in 0..<count {
+            let candidatePart = i < candidateParts.count ? candidateParts[i] : 0
+            let currentPart = i < currentParts.count ? currentParts[i] : 0
+            if candidatePart != currentPart {
+                return candidatePart > currentPart
+            }
+        }
+        return false
+    }
+
+    private static func versionComponents(_ version: String) -> [Int] {
+        var trimmed = version
+        if trimmed.hasPrefix("v") {
+            trimmed.removeFirst()
+        }
+        return trimmed.split(separator: ".").map { Int($0) ?? 0 }
+    }
+}