Release Atrium Capture 1.0.1 with automated Mac packaging

[krishagel]

Summary

• removes the stale Chrome Web Store contact guidance
• hardens native recording with durable scope selection, ordered capture draining, retries, bounded diagnostics, and input/scroll coalescing
• adds a verified universal Apple silicon + Intel .pkg with the system Chrome native-host manifest
• adds fail-closed Developer ID signing, notarization, stapling, Gatekeeper assessment, checksums, and release manifests
• adds a one-action version/tag/draft-release workflow for future Jamf releases

Verification

• pnpm check
• universal pnpm package:mac payload/checksum verification
• 109 TypeScript tests, 2 extension-loaded Chromium tests, and 76 Swift tests
• native redaction/metadata, production gateway, pin, and native-host release verifiers

Privacy and security

No capture data, tokens, or real district screenshots are added. The installer ships only the app and metadata-only native messaging manifest. Distribution publishing fails unless the app and package use Developer ID identities, Apple notarization is stapled, Gatekeeper accepts the package, and the manifest reports distributionReady: true.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.