[v3 release] Restore Beta desktop artifacts and signing evidence

[taliesin-ai]

Release-health evidence\n\nThe first public Beta publications do not yet satisfy the release artifact/signing contract:\n\n- v3.0.0-beta.0 was published by successful Release v3 run https://github.com/wailsapp/wails/actions/runs/30747695287 with Linux amd64/arm64, Windows amd64, macOS amd64/arm64/universal, and SHA256SUMS.\n- The tag-triggered v3.0.0-beta.1 run failed preflight because Apple signing credentials were absent: https://github.com/wailsapp/wails/actions/runs/30748399250. Commit 6603cde then removed the signing/notarization preflight and steps; manual run https://github.com/wailsapp/wails/actions/runs/30748402783 published the same platform set as unsigned macOS binaries.\n- v3.0.0-beta.2 was published at 2026-08-02T15:26:01Z from d40990b with zero release assets and no matching Release v3 run. It is currently the newest Beta release.\n- .release/v3.0.0-beta.0/plan.json still records all 38 gates open, including 27 blocking gates; sw-artifacts, sw-signing, and sw-install have not passed or been waived.\n\n### Impact\n\nThe newest published Beta release has no downloadable CLI binaries, while the preceding Beta macOS binaries are explicitly unsigned/unnotarized. That is release-channel breakage and cannot be represented as a green artifact, signing, or install gate.\n\n### Acceptance criteria\n\n- [ ] Release lead decides and records the macOS signing/notarization policy (configured credentials, or an explicit evidenced waiver).\n- [ ] The release workflow enforces that policy without silently downgrading security.\n- [ ] A human-authorized release action attaches the expected desktop-contract artifacts and checksums/provenance to the current Beta tag/release.\n- [ ] Installation is verified from the published channel on the supported platform set.\n- [ ] plan.json and #5844 are updated strictly from resulting evidence.\n\nThis automation will not dispatch workflows, create tags, publish/replace releases, or choose the signing waiver. It can safely reconcile the ledger/dashboard and prepare a focused workflow fix after the release-lead policy decision.

[coderabbitai]

🔗 Related PRs

#5318 - ci: add release-v3.yml workflow for signed v3 binary releases [merged]
#5490 - docs(v3): update README — replace 'v3 Alpha' with Beta scope statement [merged]
#5647 - ci: fix runtime publish (tag/Node), commit regenerated runtime back, auto-commit sponsor image [merged]
#5815 - ci(v3): harden the release workflow before its first run [merged]
#5863 - chore(release): prepare v3 beta release branch for merge [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[taliesin-ai]

Release-health evidence is now reconciled without changing any gate status.\n\n- Restored the deleted releases/v3-beta branch from current master.\n- Pushed evidence-ledger updates in dc623bb covering beta.0/beta.1 workflow runs, beta.2 zero assets, unsigned macOS publication, changelog/announcement evidence, and the missing install/runbook evidence.\n- Validation passed: JSON parse, diff check, 38 gates open, 27 blocking gates open, zero passed/waived. The installed CodeRabbit CLI does not support --plain; its equivalent plain review completed for the substantive change with no findings, then the free OSS review limit blocked the timestamp-only follow-up.\n- Updated #5844 with the published-tag/Project-stage mismatch and this blocker.\n\nNo release workflow was dispatched; no tag or release was created or modified. The remaining blocker is release-lead policy/credentials and a human-authorized artifact publication plus published-channel install verification.