[tevass]

Summary

The v0.4.0 publication run could not start its Apple Silicon build because GitHub cancelled the scheduled macos-14 runner during its retirement brownout.

• Map macos-14 artifact-plan entries to macos-15 in the publication workflow so existing signed tags can still be built.
• Configure macos-15 explicitly for future Apple Silicon cargo-dist plans.
• Document the runner compatibility behavior in the publication specification.

The source tag, approval gate, five artifact targets, and signing/publication permissions remain unchanged. This unscoped ci: change does not match the configured release-commit filter.

Failed run: https://github.com/runrly/zwd/actions/runs/41252666660

Validation

• actionlint 1.7.12 passed for the release workflow.
• cargo-dist 0.32.0 generated a plan using macos-15 for aarch64-apple-darwin.
• Compared all five targets with the failed run's plan and verified the old-tag runner fallback.
• Cargo metadata (--locked --no-deps) and git diff --check passed.
• Verified the commit title does not match release_commits.

Impact

• CLI behavior changed
• Workspace format changed
• Dock safety behavior changed
• Release flow changed
• Documentation only

Security and Supply Chain

• No secrets, credentials, private paths, or generated release artifacts were added.
• New or changed dependencies are necessary and reflected in lockfiles. No dependencies changed.
• GitHub Actions changes use least-privilege permissions.