feat(release): gate brand platform build matrix

[AprilNEA]

Summary

Implements Linear CODE-559 as a stack on #428 (xuan/code-558@77f3fb89d4268ffa93a9cc70d5281b5496b7318e).

• adds a strict brand × Desktop/iOS/Android release matrix that consumes CODE-558's immutable rendered brand artifacts and release-manifest bindings
• validates protected render/sign/upload inputs, exact store-compliance attestations, disclosed configurable features, destination uniqueness, and per-brand credentials
• isolates render roots, build roots, artifacts, upload destinations, EAS projects, App Store apps, and R2 credential prefixes per brand
• writes and re-verifies create-once provenance for artifact bytes, client commit, brand manifest, defaults, config revision, snapshot, release manifest, publisher, and source commits
• blocks publication for every brand until aggregate preflight succeeds, and rejects executable-code configuration or undisclosed review-feature surfaces
• documents the exact protected release environment vars/secrets and least-privilege contract

No LinkCode HQ change is required: this workflow consumes the immutable CODE-558 publisher output without changing render semantics.

Verification

• pnpm check:ci
• pnpm test — 331 files passed, 2,806 tests passed, 1 skipped
• focused CODE-559 Vitest suite — 31 passed
• focused TypeScript build for packages/foundation/common and apps/mobile
• workflow YAML parsed with the repository's yaml dependency (actionlint was unavailable locally)
• real unsigned Linux x64 Desktop package: Debian + AppImage generated; packaged asar contains the exact rendered bundle bytes
• CI=1 EXPO_NO_TELEMETRY=1 pnpm -F @linkcode/mobile smoke:export — iOS and Android production Metro/Hermes bundles exported
• clean credential-free Expo prebuilds for iOS and Android
• provenance creation + verification passed for Desktop/iOS/Android evidence at this PR head

No production credentials were used. Nothing was signed, uploaded, store-submitted, or released. Android SDK was unavailable locally, so Android evidence is Hermes export + clean native prebuild rather than an APK/AAB; iOS is likewise unsigned and not an IPA.

Checklist

• pnpm check:ci and pnpm test both pass (no Rust changes)
• I ran the affected surfaces and observed the change working
• No wire message changed
• New code and assets are my own work
• Docs and comments are updated where behavior changed

[linear-code]

CODE-559

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at 11am (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.