Publish v1.0.0-rc.3 update feed

[hazennik]

Summary

• publish the verified v1.0.0-rc.3 appcast through the protected prerelease feed
• point installed release candidates at the signed and notarized RC.3 zip

Release Verification

• the appcast was downloaded from the immutable GitHub prerelease and validated before staging

Safety

• No permanent delete path added.
• Cleanup still uses Trash or approved simctl actions.
• Active simulators remain protected.
• No safety behavior changed.
• No personal signing identity or Team ID committed.
• No new privacy-sensitive path or metadata reads.

Validation

• Published release asset validation passed
• Prerelease feed staging validation passed
• Documentation link validation passed
• Diff whitespace validation passed
• Full protected CI and CodeQL required before merge