[ymote]

Opening an App Hub issue requests publication, for first versions and updates. The previous default instructions asked developers to generate and retain an Ed25519 publisher key. This change installs a GitHub tag-release workflow that attests the exact app manifest and bundle digest using GitHub's job identity, without a developer signing key or repository signing secret. The resulting release pack is review evidence for the issue; a Hub administrator still reviews and approves admission.

tools/octo new includes the workflow; publish-github adds it to existing editable repositories without overwriting custom automation. Tools preserve sealed releases: check does not restamp them, and run refuses them before startup or file writes. English/Chinese guides distinguish the default publishing path from optional legacy local-store rehearsals. The template's Add button also retains its visible colors when focused, a defect found in the real fixture run.

Validation:

• 18 Python tests pass, covering workflow installation, immutable toolchain pins, sealed-byte preservation and ordinary unsigned manifests with null signatures. Documentation links and actionlint pass.
• Real keyless fixture release workflows passed for v0.1.0 and v0.1.1, with no repository secrets.
• Native Store acceptance passed all nine groups: install, verified launch, update, proof retention, tamper and rollback rejection, unsigned ownership escape rejection, and withdrawal. This used an isolated local test catalog, not production Hub admission.
• The editable fixture was exercised in a hidden native Mac window: add, remove, persistence after restart, and actual screenshot capture.

App Hub #153 and #154 are merged. The generated workflow pins merged toolchain 655114c4943cd2490daaefa2173e7b5aaa20669f; app-contract 1.8.0 is published on crates.io (publication run 37739082884). The two original fixture workflows used public source c11de1d7, as recorded in their receipts. A compatible OctoSense release and shell/phone installation acceptance remain pending. No fixture submission issue was opened and no fixture was added to the public catalog.