Standardize BonsAI branding, CI, and signed releases

[ojowwalker77]

Summary

• ships the selected BonsAI v1 icon as both the 1024 px build source and an editable Icon Composer package
• points Sparkle at ojowwalker77/BonsAI and removes stale kiwi-init/BonsAI integration links
• adds the shared bootstrap, run, check, verify, and release-preflight developer contract
• makes CI run both the Swift quality gate and a staged-app release smoke test, with one required Quality aggregate
• moves contributions to short-lived branches targeting main
• makes public releases fail closed unless Developer ID, App Store Connect API-key notarization, and Sparkle credentials are available
• validates tag provenance, signatures, notarization tickets, Gatekeeper acceptance, checksums, and the signed Sparkle appcast before publishing

Why

The installed app was still checking an upstream repository for updates, and the release workflow could publish unsigned, unnotarized artifacts when credentials were missing. Developer and release commands also differed from the shared contract planned for TeaCode, BonsAI, and Lua Browser.

This gives BonsAI a single reproducible path from checkout to a trusted public release without renaming the internal Composer Swift module or storage paths in this PR.

User and developer impact

Users receive the coordinated app icon and updates from the correct repository. Public downloads can no longer silently degrade to unsigned builds.

Contributors can use:

./script/bootstrap
./script/run
./script/check
./script/verify
./script/release-preflight X.Y.Z

Maintainers must configure the standardized release secrets documented in docs/releasing.md before the next release.

Validation

• ./script/bootstrap
• ./script/check — release build and 169 tests, all passing
• ./script/verify
• BONSAI_VERIFY_EXISTING=1 ./script/verify
• clean-tree ./script/release-preflight 1.4.7
• Bash syntax checks for every changed/new script
• YAML parse for CI and release workflows
• Icon Composer JSON parse and 1024×1024 master verification
• git diff --check

The actual Developer ID signing/notarization job requires repository secrets and is intentionally left to the draft PR checks or a controlled release run.