ci(macos): package private CA builds on hosted runner

[BrianInAz]

Summary

• move the private-CA macOS package step from Brian's MacBook to the free standard GitHub-hosted macos-15 Apple Silicon runner
• preserve Brian's explicit build-approved issue gate
• apply an immutable two-commit patch series: private-CA trust plus the RUSTSEC-2026-0224 event-integrity correction
• reject vulnerable root and Apple Silicon desktop dependency graphs before validation and again before packaging
• ad-hoc sign, verify, checksum, and upload a seven-day candidate artifact without Apple or homelab secrets
• keep private WSS on the existing homelab ghRunner and reserve Brian's MacBook for state-preserving install/runtime acceptance
• fail closed if either patch SHA differs, either patch conflicts, the repository is private, or the resolved runner is not ARM64
• keep pull-request Docker validation build-only: PRs may read registry caches but never authenticate to GHCR or export cache layers; non-PR image publication remains canonical-upstream-only

Why

The fork is public, so standard GitHub-hosted runner compute is free and provides a reproducible M1 build environment. The hosted lane separates repeatable package production from Brian's final runtime acceptance.

While validating the lane, the repository Security job identified RUSTSEC-2026-0224 in nostr-relay-pool 0.44.1. Buzz has independent root and desktop lockfiles; upstream block#4139 corrected only the root lock. This PR now certifies 0.44.2 in both lockfiles and refuses to package a candidate unless both graphs are advisory-clean.

Tracking and upstream retirement path:

• internal: https://github.com/BjzyLabs/homelab-playbooks/issues/2285
• upstream issue: fix(desktop): update nostr-relay-pool for RUSTSEC-2026-0224 block/buzz#4251
• upstream PR: fix(desktop): update vulnerable nostr relay pool block/buzz#4256

Validation

• failing contract reproduced against the previous single-patch workflow
• scripts/test-private-ca-release-contract.sh — passed
• bash -n scripts/build-private-ca-macos.sh scripts/test-private-ca-release-contract.sh — passed
• shellcheck scripts/build-private-ca-macos.sh scripts/test-private-ca-release-contract.sh — passed
• yamllint .github/workflows/private-ca-release.yml — passed
• workflow YAML parse — passed
• Markdown lint and git diff --check — passed
• locked root and Apple Silicon desktop cargo-deny advisory scans — passed
• patch series applied cleanly and both scans passed against exact v0.5.2 and v0.5.3 source SHAs
• upstream just ci: root, Rust, desktop, and web gates passed; one unrelated paused-clock timing test failed in the parallel desktop suite and passed immediately in isolation
• reproduced the fork PR's GHCR cache-export denial, then added a contract and changed PR Docker jobs to build-only without registry authentication or writes; fork main pushes cannot publish into Block's namespace

Controlled acceptance

Merge and verify the monitor/validation changes first. Reconcile the existing unapproved v0.5.3 ticket to the two-SHA marker. Do not add build-approved, build a package, run private WSS, or install anything without a separate explicit decision from Brian.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.