Publish source materials for the bundled Git runtime

[zhiiw]

What changed

• add a release-time source-material publisher for every component pinned into the Dugite Git distribution;
• materialize commit-addressed source archives plus a machine-readable manifest containing repository, revision, license, size, and SHA-256 evidence;
• publish the source-material archive and checksum alongside every desktop GitHub Release;
• package the GPLv2 license, component notice, and a written complete-corresponding-source offer in the application;
• make packaged-app verification and the release checklist require the source offer and release assets;
• document the source-publication boundary separately from bundled Git runtime admission.

Why

The bundled Git runtime merged in #2199 is invoked as a separate command-line program, so it does not change Maka's Apache-2.0 license. Distribution still carries upstream license and source-availability obligations. Runtime trust and source publication have different owners and rollback boundaries, so this PR handles only the latter.

The attached archives provide immediate, revision-pinned source materials. The packaged written offer remains the authority for requests for complete corresponding source, including applicable build and installation scripts, for the stated period.

User and developer impact

• every desktop release gains a checksummed bundled-Git source archive;
• every packaged application carries the applicable license, notice, and source-request procedure;
• runtime execution, managed-workspace behavior, and Git admission identity are unchanged;
• generated source archives remain release artifacts and are not committed to the repository.

Validation

• source-material generation, provenance rejection, owned-output replacement, source-offer/release wiring, bundled Git preparation, and Electron Builder configuration: 9 passed;
• git diff --check: passed.

The local check:third-party-notices command observed stale pre-rebase node_modules metadata for the newly updated AI SDK on main; this PR does not modify that lockfile/notice surface, and CI runs from a clean install.

中文说明

修改内容

• 增加发布期 source-material 生成器，覆盖 Dugite Git distribution 固定的全部组件；
• 下载 commit-addressed source archive，并生成包含仓库、revision、license、大小与 SHA-256 的机器可读 manifest；
• 每次 Desktop GitHub Release 同步发布 source-material archive 与校验文件；
• 在应用包内携带 GPLv2 license、组件说明以及完整对应源码的书面提供承诺；
• packaged-app 校验和发布 checklist 强制检查 source offer 与发布资产；
• 将 source publication 与 bundled Git runtime admission 明确拆成两个独立责任边界。

原因

#2199 引入的 bundled Git 以独立命令行程序方式运行，因此不会把 Maka 自身的 Apache-2.0 许可证改变为 GPL；但发布者仍需要履行上游许可证与源码可获得性义务。Runtime trust 与 source publication 的 owner、失败方式和回滚边界不同，所以本 PR 只处理后者。

Release 附件提供可立即下载、绑定具体 revision 的 source materials。应用内的书面 offer 继续作为请求完整对应源码（包括适用的构建和安装脚本）的权威入口。

影响

• 每个 Desktop release 增加带校验值的 bundled Git source archive；
• 每个应用包携带许可证、notice 与源码请求方式；
• 不改变 runtime execution、managed workspace 行为或 Git admission identity；
• 生成的源码归档属于 release artifact，不提交进仓库。

验证

• source material 生成、provenance 拒绝、owned output 替换、source offer/release 接线、bundled Git preparation 与 Electron Builder 配置共 9 项通过；
• git diff --check 通过。

本地 check:third-party-notices 读取到了 rebase 前旧的 node_modules AI SDK 元数据；本 PR 不修改对应 lockfile/notice，CI 会使用 clean install 验证。