- ci.yml declares permissions: contents: read instead of the default
token scope.
- Every action is pinned to the commit its current tag points at
(checkout v4.4.0, upload-artifact v4.6.2, action-gh-release v2.6.2),
so a moved tag can't change what runs with release write access.
- A cargo audit job runs on every push; the single ignored advisory
(RUSTSEC-2023-0071, rsa via russh, no fix available) is recorded with
its rationale in rust/.cargo/audit.toml (SEC-20261012-019, -012).
Release signing and macOS notarisation are not part of this change.
Renames the product across the codebase: Go module path, config/data
paths, keychain service name, export file extension, build tooling,
docs, and UI text. Sidebar brand mark now reads ">_ AlchementaryLink"
with "Alchementary" in the connection-group gold accent colour, and
the window title is "Alchementary Link".
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019T8bJS8BCtY5GeSG2HBj1n
Andy Dixon
