[iamtoruk]

Hardens the release pipeline, from the security audit.

Signing jobs need an approval. The four jobs that use signing or store keys now run in the release environment:

• release-menubar.yml (macOS menubar);
• build-desktop-mac.yml (macOS desktop);
• release-menubar-windows.yml (Windows menubar, Tauri updater key);
• build-snap.yml.

The environment already exists. It requires approval from @iamtoruk and only runs from main or the v*, mac-v*, windows-v* and desktop-v* tags. A workflow on any other branch cannot reach it.

In build-snap.yml the store upload moves into its own publish job, which downloads the snap artifact. Pull request builds of the snap therefore never wait for an approval.

Every action is pinned to a commit. All 48 uses: lines point at the commit their tag resolves to today, with the release in a comment (for example actions/checkout@d23441a… # v6.1.0), so nothing runs differently. A moved or hijacked tag can no longer change what runs next to our signing keys. Dependabot's existing github-actions entry keeps the pins current.

After merging, the secrets have to move. Environment protection only guards secrets stored in the environment. All 9 signing secrets are repository secrets today, which any workflow on any pushed branch can read. A maintainer has to:

1. add them to the release environment under the same names, because secret values cannot be copied through the API;
2. run one gated workflow to confirm the new copies work;
3. delete the repository-level copies.

Checked: every workflow parses, and actionlint 1.7.12 reports nothing.