Add repo picker, update checker, and distribution tooling1.0.00.7.00.6.0

Closes #11-#15 (milestones 0.6.0, 0.7.0, 1.0.0).

- Repo picker: on-demand broader OAuth scope (security_events repo),
  requested only when the "Browse your repos" action is used, never by
  default. Lists /user/repos via the existing pagination helper. Granted
  scope persisted with backward-compatible decoding for existing state
  files. Fixed a bug where a failed re-auth force-signed-out a user who
  already had a valid narrower-scope token.
- Update checker: polls this repo's GitHub Releases API, surfaces a
  banner linking to new releases. Skipped on the Mac App Store build via
  a runtime receipt check rather than a separate build configuration.
- Fixed MARKETING_VERSION, stuck at Xcode's default "1.0" this whole
  time unrelated to our git tags — now 1.0.0, matching this release.
- Added PrivacyInfo.xcprivacy (no tracking, no collected data).
- Added scripts/build-dmg.sh (archive, Developer ID export, notarize,
  staple) and Casks/octosentry.rb (Homebrew Cask template), plus
  DISTRIBUTION.md documenting both channels end to end.

Entitlements were already identical across all builds — no divergence
needed there. What remains for actual App Store submission and notarized
DMG builds is account-specific (Apple Developer Program membership,
certificates, App Store Connect submission) and can't be done from here;
documented clearly in DISTRIBUTION.md.

1 files changed, 76 insertions, 0 deletions

diff --git a/scripts/build-dmg.sh b/scripts/build-dmg.sh
new file mode 100755
index 0000000..14bd608
--- /dev/null
+++ b/scripts/build-dmg.sh
@@ -0,0 +1,76 @@
+#!/bin/bash
+#
+# build-dmg.sh
+#
+# Builds a notarized, Developer-ID-signed DMG for direct distribution
+# (spec §9: DMG/Homebrew channel). Requires local one-time setup this
+# script does NOT do for you:
+#
+#   1. A "Developer ID Application" certificate in your keychain, tied to
+#      an active Apple Developer Program membership. Xcode > Settings >
+#      Accounts > Manage Certificates > + > Developer ID Application.
+#   2. Notarization credentials stored once via:
+#        xcrun notarytool store-credentials "octosentry-notary" \
+#          --apple-id "[email protected]" \
+#          --team-id "YOUR_TEAM_ID" \
+#          --password "an-app-specific-password"
+#      (App-specific password from appleid.apple.com, not your main
+#      Apple ID password.)
+#
+# Usage: scripts/build-dmg.sh [version]
+# Output: build/octosentry-<version>.dmg
+
+set -euo pipefail
+
+VERSION="${1:-dev}"
+PROJECT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+BUILD_DIR="$PROJECT_DIR/build"
+ARCHIVE_PATH="$BUILD_DIR/octosentry.xcarchive"
+EXPORT_PATH="$BUILD_DIR/export"
+EXPORT_OPTIONS_PLIST="$BUILD_DIR/export-options.plist"
+DMG_PATH="$BUILD_DIR/octosentry-$VERSION.dmg"
+NOTARY_PROFILE="octosentry-notary"
+
+rm -rf "$BUILD_DIR"
+mkdir -p "$BUILD_DIR"
+
+echo "==> Archiving (Release configuration)"
+xcodebuild archive \
+  -project "$PROJECT_DIR/octosentry.xcodeproj" \
+  -scheme octosentry \
+  -configuration Release \
+  -archivePath "$ARCHIVE_PATH"
+
+cat > "$EXPORT_OPTIONS_PLIST" <<PLIST
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>method</key>
+	<string>developer-id</string>
+</dict>
+</plist>
+PLIST
+
+echo "==> Exporting (Developer ID)"
+xcodebuild -exportArchive \
+  -archivePath "$ARCHIVE_PATH" \
+  -exportPath "$EXPORT_PATH" \
+  -exportOptionsPlist "$EXPORT_OPTIONS_PLIST"
+
+APP_PATH="$EXPORT_PATH/octosentry.app"
+
+echo "==> Notarizing"
+DMG_STAGING="$BUILD_DIR/staging"
+mkdir -p "$DMG_STAGING"
+cp -R "$APP_PATH" "$DMG_STAGING/"
+ln -s /Applications "$DMG_STAGING/Applications"
+
+hdiutil create -volname "octosentry" -srcfolder "$DMG_STAGING" -ov -format UDZO "$DMG_PATH"
+
+xcrun notarytool submit "$DMG_PATH" --keychain-profile "$NOTARY_PROFILE" --wait
+
+echo "==> Stapling notarization ticket"
+xcrun stapler staple "$DMG_PATH"
+
+echo "==> Done: $DMG_PATH"