[ssddOnTop]

Summary

• clean persistent self-hosted workspaces before release artifact extraction
• preserve the verified Sparkle signing tool through the release handoff instead of downloading it after notarization
• make intermediate artifacts rerun-safe and retain them for seven days
• verify final transfer checksums before publishing
• make appcast staging and stale asset cleanup explicit
• upload replacements before removing obsolete DMGs
• add focused release-finalization fixture tests to CI

Validation

• actionlint .github/workflows/*.yml
• bash -n and shellcheck for release finalization helpers
• .github/scripts/test-release-finalization.sh
• git diff --check

[ssddOnTop]

fixed in #34