Harden release and packaging supply chain

[rodrigoantonioli]

Summary

• validate release tags as data and separate unprivileged builds from protected publication
• pin GitHub Actions, Python build dependencies, Inno Setup, and WingetCreate to verified immutable inputs
• redact user-profile prefixes from copied diagnostics and document the release security invariants

Validation

• ruff check .
• pytest -q (107 passed)
• actionlint
• clean hash-locked installs in disposable Python 3.13 environments
• local EXE/Inno build
• unsigned MSIX pack/unpack and repeat-build cleanup
• verified official Inno Setup and WingetCreate hashes and Authenticode signatures without executing them locally

Safety

No version, tag, GitHub Release, WinGet submission, certificate, or Microsoft Store state was changed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7504f32f2b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restrict release-tag digits to ASCII

In PowerShell/.NET regexes, \d matches Unicode decimal digits, so a tag such as v1.1٢.0 passes this supposedly strict validator. The workflow then treats it as a stable release and can build/publish an installer before WinGet or other version consumers reject the non-ASCII version; use [0-9] throughout the pattern and add a Unicode-digit rejection test.

AGENTS.md reference: AGENTS.md:L260-L261

Useful? React with 👍 / 👎.