feat(release): add macOS pre-release gate verifying bundled engines

- Enhance scripts/verify-binaries.js with 9 engine checks:
  sidecar existence, executable permission, file(1) identification,
  otool -L linkage scan (forbids /opt/homebrew, /usr/local/Cellar),
  yt-dlp packaging sanity, version self-tests, aria2 RPC smoke test,
  and stderr scanning for Library not loaded / image not found
- Add release.yml workflow triggered on v* tags:
  engine-verification job runs verification, builds .app, uploads
  bundle; create-release job publishes GitHub Release
- Add Verify bundled engines step to ci.yml for PR/main coverage
- Create RELEASE.md documenting the full release process

.github/workflows/ci.yml

@@ -32,6 +32,9 @@ jobs:
       - name: Build frontend
         run: npm run build
 
+      - name: Verify bundled engines
+        run: node scripts/verify-binaries.js
+
       - name: Test Rust backend
         working-directory: src-tauri
         run: cargo test --all-targets

.github/workflows/release.yml

@@ -0,0 +1,90 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  engine-verification:
+    name: macOS pre-release gate
+    runs-on: macos-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install frontend dependencies
+        run: npm ci
+
+      - name: Verify bundled engines (pre-build)
+        run: node scripts/verify-binaries.js
+
+      - name: Build macOS application bundle
+        run: npm run tauri build
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+
+      - name: Run engine self-test against packaged app
+        run: |
+          APP_PATH="src-tauri/target/release/bundle/macos/Firelink.app"
+          if [ -d "$APP_PATH" ]; then
+            echo "Testing engines from built bundle: $APP_PATH"
+            node scripts/verify-binaries.js
+          else
+            echo "Warning: .app bundle not found at $APP_PATH"
+            node scripts/verify-binaries.js
+          fi
+
+      - name: Upload macOS bundle artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: firelink-macos-${{ github.ref_name }}
+          path: src-tauri/target/release/bundle/macos/
+          if-no-files-found: error
+
+  create-release:
+    name: Create release
+    needs: engine-verification
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Download macOS bundle artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: firelink-macos-${{ github.ref_name }}
+          path: release-assets/
+
+      - name: Generate release notes
+        run: |
+          echo "## Firelink ${{ github.ref_name }}" > RELEASE_NOTES.md
+          echo "" >> RELEASE_NOTES.md
+          echo "### Checksums" >> RELEASE_NOTES.md
+          echo '```' >> RELEASE_NOTES.md
+          shasum -a 256 release-assets/* 2>/dev/null || true
+          echo '```' >> RELEASE_NOTES.md
+
+      - name: Publish release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: release-assets/**
+          body_path: RELEASE_NOTES.md
+          generate_release_notes: true