feat(portable): add macOS universal bundle manifest support

Add support for macOS universal portable runtime bundles with platform-specific
member selection through bundle-manifest.json.

- add PortableBundleManifest and PortableRuntimeSelection interfaces
- add mapProcessArchToMacosPlatform for architecture mapping
- add parsePortableBundleManifest for manifest parsing
- add getPortableRuntimeBundleRoot and getPortableRuntimeSelection methods
- update initializeDistributionMode with detailed logging for bundle selection
- add tests for bundle manifest and platform selection detection

Co-Authored-By: Hagicode <[email protected]>
Signed-off-by: newbe36524 <[email protected]>

feat(renderer): add auto-switch option to homepage version install

Enable automatic version switching after installation from the homepage
when the service is idle, with contextual success feedback.

Changes:
- update SystemManagementView to pass autoSwitchWhenIdle option
- add i18n toast messages for install success variants
- add integration test for homepage auto-switch behavior
- ensure active-version updates refresh version card

Co-Authored-By: Hagicode <[email protected]>
Signed-off-by: newbe36524 <[email protected]>

refactor(version-manager): return detailed result from setSourceConfig

Update VersionManager.setSourceConfig to return a detailed result object
with success status and optional error message instead of a boolean.

Changes:
- update setSourceConfig return type from boolean to result object
- update packageSourceHandlers to handle result object
- update viewHandlers to use diagnostic view type

Co-Authored-By: Hagicode <[email protected]>
Signed-off-by: newbe36524 <[email protected]>

test(dependency): add boundary and contract tests for dependency refa…

…ctoring

Add comprehensive tests to verify the dependency boundary refactoring
and ensure IPC contracts are properly maintained.

Changes:
- add version-management-dependency-boundary.test.ts for main process boundary tests
- add version-bridge.contract.test.ts for preload bridge contract tests
- update versionManagement.installProgress.render.test.ts with UI removal assertions

Co-Authored-By: Hagicode <[email protected]>
Signed-off-by: newbe36524 <[email protected]>

feat(build): add GitHub Release mirror support to hybrid metadata bui…

…lder

Add structured download source support to the build pipeline, enabling
official and GitHub Release mirror sources in published HTTP index metadata.

Changes:
- add ArtifactDownloadSource model with Kind, Label, Url, Primary, WebSeed
- add ArtifactDownloadSourceKinds constants (Official, GitHubRelease)
- add DownloadSources list to PublishedArtifactMetadata
- add gitHubRepository parameter to IArtifactHybridMetadataBuilder.BuildAsync
- add CreateOfficialDownloadSource and TryCreateGitHubReleaseDownloadSource
- add AddDownloadSource helper to append sources without duplicates
- add GitHub repository normalization and name resolution to BuildConfig
- update AzureBlobAdapter to accept gitHubRepository constructor parameter
- update AzureBlobAdapter index validation with stricter schema checks
- add BuildIndexResult refactoring for index generation
- add comprehensive tests for GitHub Release mirror URL generation
- update AzureBlobAdapterTests for index validation edge cases

Co-Authored-By: Hagicode <[email protected]>
Signed-off-by: newbe36524 <[email protected]>

feat(system-vault): add desktop system-managed vault environment support

Add support for desktop-owned system-managed vault descriptors that map to

ASP.NET Core hierarchical env keys for the managed backend child process.

Changes:

- add getDesktopLogsDirectory, getDesktopAppsRoot, getDesktopConfigDirectory to PathManager

- add system-vault-env.ts module with buildDesktopSystemVaultEnv function

- add SYSTEM_MANAGED_VAULT_ADDITIONAL_DIRECTORIES_ENV_PREFIX constant

- add systemVaultEnvEntries to BuildManagedEnvInput interface

- add warnings array to BuildManagedEnvResult interface

- integrate system vault env building in web-service-manager startup

- prevent inherited process-level system vault env values from leaking

- log desktop system-managed vault roots in app initialization

- add tests for buildDesktopSystemVaultEnv with various scenarios

Co-Authored-By: Hagicode <[email protected]>
Signed-off-by: newbe36524 <[email protected]>

refactor(github-oauth): remove GitHub OAuth handlers implementation file

Delete the GitHub OAuth handlers implementation file from the main process.

Changes:

- delete githubOAuthHandlers.ts implementation

Co-Authored-By: Hagicode <[email protected]>
Signed-off-by: newbe36524 <[email protected]>

feat(version-management): track installing version ID for per-version…

… progress display

Add installingVersionId state to webServiceSlice so only the version card
currently being installed shows progress UI, preventing all version cards
from displaying progress when a single install is in flight.

Changes:
- add installingVersionId field and setInstallingVersionId action to webServiceSlice
- export selectInstallingVersionId selector for component use
- update VersionManagementPage to pass version.id to renderInstallTelemetry
- show progress/loading UI only for the matching version.id in version list
- dispatch setInstallingVersionId in installWebServicePackage thunk on start/success/error
- dispatch setInstallingVersionId in confirmInstallAndStop thunk on start/error
- add unit test for installingVersionId lifecycle in webServiceSlice
- add render test verifying per-version progress rendering logic

Co-Authored-By: Hagicode <[email protected]>

chore(openspec): remove archived change proposals and cleanup

Remove all archived OpenSpec-related change proposals, design documents, and task files
from the openspec/changes/archive directory. This cleanup follows the removal of OpenSpec
as a dependency from the project.

Changes:
- remove openspec/.version file
- remove all archived change directories from 2025-02-07 through 2026-02-15
- remove OpenSpec-related proposal, design, spec, and task files

Co-Authored-By: Hagicode <[email protected]>

ci(build): exclude DLL files from Windows signing scope

Remove .dll extension from signable file lists in Windows ZIP payload signing steps to reduce signing overhead. Update terminology to accurately describe signed files as executables/packages rather than general binaries.

Changes:

- remove .dll from signable extensions filter in both required and optional signing jobs

- update summary text from "binaries" to "executables/packages" for clarity

- update artifact-signing.md to document that only exe/appx/msix/msi files are signed

Co-Authored-By: Hagicode <[email protected]>