release: publish and anonymously verify v1.1.2 installer assets

Summary

Publish v1.1.2 with complete immutable installer assets and verify every public download without GitHub authentication.

Proposed Approach

• Generate assets from the v1.1.2 tag using the release workflow.
• Verify the manifest pins the public runtime image digest.
• Publish only after checksums and inventory match.
• Download anonymously and verify hashes before execution.
• Exercise documented macOS and Windows bootstrap entry points.

Acceptance Criteria

• v1.1.2 is a non-draft production release.
• Required macOS, Windows/WSL2, manifest, and checksum assets are attached.
• Checksums match locally regenerated values from tagged source.
• Manifest pins an anonymously pullable runtime digest.
• Every asset downloads and verifies without credentials.
• Notes cover supported hardware, privacy, limitations, rollback, and security reporting.

Related

• Parent epic: #40
• Depends on public repository/runtime publication.
• Do not publish npm.

Start with the release workflow and the v1.1.2 tag, then inspect the documented macOS and Windows/WSL2 bootstrap entry points. Regenerate checksums and compare the asset inventory and runtime image digest. Done means the production release has all required assets, anonymous downloads verify successfully, and the notes cover the listed support, privacy, rollback, and security topics.