fix(ci): unblock v0.5 release builds

[MikeRoss27]

Summary

• build Linux release assets on Ubuntu 24.04, matching the ONNX Runtime glibc baseline already documented by the Tantivy benchmark
• pause macOS Intel artifacts because upstream ort no longer ships x86_64-apple-darwin binaries
• make the macOS bundle smoke test compatible with the system Bash 3.2 (replace mapfile)
• stop the changelog workflow from pushing directly to protected main; upload its generated preview instead
• align release documentation and download claims

Evidence

Release run 34779221109 exposed three independent pipeline failures:

• Ubuntu 22.04: missing C23 glibc symbols required by the downloaded ONNX Runtime
• macOS Intel: no upstream ORT binary exists for x86_64-apple-darwin
• macOS ARM smoke test: mapfile is unavailable in Apple system Bash 3.2

Validation

• git diff --check
• Prettier check for modified workflow/docs files
• bash -n scripts/macos-smoke.sh
• ShellCheck when available

After merge, manually dispatch release.yml from main with version=v0.5.0. The application source and existing tag remain unchanged.

[itoqa]

Commit: 7fde315: 14 test cases ran, 14 passed ✅.

Summary

Coverage spans normal release and changelog flows, permission boundaries, safe artifact handling, and macOS packaging and launch validation. It also exercises edge and adversarial cases such as missing or duplicate files, metadata mismatches, tool failures, stale content, and expected ad-hoc security rejection behavior.

Safe to merge — the exercised behaviors are healthy with no PR-attributable regressions, new failures, or previously flagged failures. Some release-page and platform-download checks remain environment-limited observations, but they do not indicate a merge blocker.

Tests run by Ito

Result	Severity	Type	Description
✅	—	General	A run that does not create a changelog fails instead of uploading an older file, so retries cannot publish stale content.
✅	—	General	The smoke check failed when mounting, signing, or starting the app failed. It tolerated only the expected Gatekeeper failure for an ad-hoc build.
✅	—	General	A changelog run with a read-only token rejected a push attempt, left protected main unchanged, and kept the generated artifact available.
✅	—	Changelog	A normal push creates CHANGELOG.md and uploads it in a seven-day artifact named for that commit. The workflow does not write back to the repository.
✅	—	Changelog	When changelog generation creates no file, the upload step fails with a missing-file error and no artifact is reported.
✅	—	Changelog	The workflow can read the repository and upload the generated changelog, but it has no permission or command path to commit or push changes.
✅	—	Macos	Release-facing content points users to the Apple Silicon macOS download. The Intel wording in the build documentation explains that Intel builds are paused, and the release workflow only mentions the Intel target during toolchain setup; neither advertises an Intel download.
✅	—	Release	The local test environment did not provide a workflow-run or release page, so the three platform builds could not be opened or inspected. The checked-in release workflow does define Apple Silicon macOS, Ubuntu 24.04, and Windows jobs, so this outcome reflects a test-environment limit rather than a confirmed product failure.
✅	—	Release	The release workflow limits Linux package installation to the Ubuntu 24.04 build. The local test app could not show job logs, but the checked-out workflow contains the expected platform matrix and condition.
✅	—	Rev	The release check was safely stopped before any release result or download could be reported. The local test environment could not load the application, even after a retry.
✅	—	Smoke	The signed Apple Silicon app and disk image passed bundle discovery, signing, mounted metadata, architecture, and launch checks.
✅	—	Smoke	The smoke check rejected missing and duplicate app, disk image, and mounted app bundles with clear errors.
✅	—	Smoke	The ad-hoc build warned that Gatekeeper rejected the app, then continued through DMG, mounted-app, architecture, and launch checks successfully.
✅	—	Smoke	A mounted app with the wrong identifier or executable name was rejected before the app could be accepted as launchable.

Tip

Reply with @itoqa to send us feedback on this test run.