ci: run signing, Store and Pages deploys in environment-gated jobs. Principle XII.

[ten9876]

Summary

The release and docs workflows now run their signing, publishing and Store steps in their own jobs, under GitHub Environments, and pass tags and inputs to scripts through env:.

• docs.yml: the build job only builds, and npm ci runs with --ignore-scripts. A new deploy job (main push/dispatch only, environment cloudflare-pages) downloads the built site and runs the pinned wrangler-action with an exact wrangler version, with no checkout. For a v* release, release-pdf renders the manual with a read-only token. A new sign-release-pdf job (environment release, no checkout) checks that the artifact is exactly the expected PDF, then signs it with a temporary GPG keyring (passphrase on stdin) and attaches it.
• macos-dmg.yml: build-dmg builds with a read-only token and uploads the unsigned bundle as a tar. A new sign-dmg job (environment release, v* tags and main; each leg runs even if the other leg's build failed) unpacks it into input/. It accepts only the staged directories, with no symlinks pointing outside them, then signs, builds the DAX PKG and DMG, notarizes, and publishes only the regular files it wrote to out/. It checks out nothing and builds nothing. The keychain is per-run with a random, masked password, both identities are imported non-exportable, and the keychain is deleted when the job ends. notarytool uses a keychain profile.
• windows-installer.yml: the draft Store submission moves to its own stage-store-draft job (environment release), and the developer-flight job runs under store-flight. Both jobs remove the Store CLI's stored credential and settings at the end. Checkouts in these jobs don't persist credentials.
• sign-release.yml: the tag is read from env: and must match a release-tag pattern. Checkout is refs/tags/<tag>, and the run stops unless the triggering build was of that tag's commit. workflow_run runs are accepted only from this repository's push/dispatch builds. The job runs under release, the workflow default token drops to contents: read, the keyring is temporary and the passphrase comes in on stdin.
• build-sherpa-onnx-aarch64.yml, static-checks.yml: dispatch inputs and base_ref reach scripts through env:.

GitHub creates the release, cloudflare-pages and store-flight environments on first use. They need their deployment rules and secrets configured before the next tag.

Constitution principle honored

Principle XII: each job gets only the credentials it uses, and the scoping is enforced by infrastructure. Principle VII: tag and input values are validated or passed as data at the boundary.

Test plan

• actionlint: no new findings on any workflow (one existing shellcheck note fixed)
• Docs site builds locally with npm ci --ignore-scripts && npm run build; this PR's own Docs run builds it again and skips deploy
• The sign-release tag check was run against release tags and malformed values
• The macOS unpack check and output check, and the release-PDF download check, were run against well-formed and malformed inputs
• macOS and Windows signing/Store paths run on the next release tag

Checklist

• Commits are signed (docs/COMMIT-SIGNING.md)
• No CHANGELOG.md edits

🤖 Generated with Claude Code

https://claude.ai/code/session_012U8wmr3AQGVrmQLp2zNBwa

[ten9876]

Reviewed revision 313b3dffa6554916f7ce87c84df32cafaac91f24.

Follow-up changes are requested. The detailed report is being supplied directly to the maintainer.