fix: harden release builds and queue scheduling

.github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Resolve version
         id: version
@@ -40,6 +40,20 @@ jobs:
         run: |
           uname -a
           swift --version
+          xcodebuild -version
+          xcode-select -p
+          xcrun --sdk macosx --show-sdk-version
+
+      - name: Verify macOS 26 SDK
+        shell: bash
+        run: |
+          SDK_VERSION="$(xcrun --sdk macosx --show-sdk-version)"
+          SDK_MAJOR="${SDK_VERSION%%.*}"
+
+          if [[ "$SDK_MAJOR" != "26" ]]; then
+            echo "Expected macOS 26 SDK, got macOS $SDK_VERSION" >&2
+            exit 1
+          fi
 
       - name: Install dependencies
         run: brew install aria2 dylibbundler
@@ -54,6 +68,7 @@ jobs:
         run: |
           file build/Firelink.app/Contents/MacOS/Firelink
           lipo -archs build/Firelink.app/Contents/MacOS/Firelink | grep -qx arm64
+          codesign --verify --deep --strict build/Firelink.app
 
       - name: Create DMG
         env:
@@ -62,7 +77,7 @@ jobs:
         run: Scripts/create_dmg.sh
 
       - name: Upload workflow artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: Firelink-${{ steps.version.outputs.version }}-mac-arm64-dmg
           path: dist/*.dmg