Add signed package installer scaffolding

[Siddhant-K-code]

Summary

Adds the first signed/package-manager installer implementation pass:

• git-ai setup-package --manager <msi|pkg|apt|brew> for conservative per-user setup after package-manager installs
• MSI, PKG, deb, and Homebrew formula packaging scaffolding with no git/git.exe shim installation
• release workflow jobs for macOS binary signing, MSI build/sign, PKG build/notarize, deb build/test, and generated git-ai.rb
• package smoke tests in CI for MSI/PKG/deb artifacts

This intentionally starts fresh instead of continuing #1322: new installers must not install Git shims or intercept git.

Secrets/vars needed before production release

Apple:

1. In Apple Developer, create Developer ID Application and Developer ID Installer certificates from a CSR.
2. Import each .cer into Keychain, export each cert+private key as .p12, then base64 encode it.
3. In App Store Connect, create a notarization API key and base64 encode the .p8.
4. Add GitHub Actions environment secrets under Settings -> Environments -> release -> Environment secrets:
   • APPLE_DEVELOPER_ID_APPLICATION_P12_BASE64
   • APPLE_DEVELOPER_ID_APPLICATION_P12_PASSWORD
   • APPLE_DEVELOPER_ID_APPLICATION_IDENTITY (Developer ID Application: ...)
   • APPLE_DEVELOPER_ID_INSTALLER_P12_BASE64
   • APPLE_DEVELOPER_ID_INSTALLER_P12_PASSWORD
   • APPLE_DEVELOPER_ID_INSTALLER_IDENTITY (Developer ID Installer: ...)
   • APPLE_NOTARY_KEY_ID
   • APPLE_NOTARY_ISSUER_ID
   • APPLE_NOTARY_KEY_P8_BASE64

Azure Artifact Signing:

1. Create/verify the Artifact Signing account, completed public identity validation, and Public Trust certificate profile.
2. Create a GitHub OIDC app registration/federated credential for this repo's release environment.
3. Grant it Artifact Signing Certificate Profile Signer on the signing account/profile.
4. Add GitHub Actions environment secrets under Settings -> Environments -> release -> Environment secrets:
   • AZURE_CLIENT_ID
   • AZURE_TENANT_ID
   • AZURE_SUBSCRIPTION_ID
5. Add GitHub Actions environment variables under Settings -> Environments -> release -> Environment variables:
   • AZURE_ARTIFACT_SIGNING_ENDPOINT
   • AZURE_ARTIFACT_SIGNING_ACCOUNT
   • AZURE_ARTIFACT_SIGNING_CERT_PROFILE

Quarantine cleanup

This PR does not remove the macOS xattr -d com.apple.quarantine fallback from install.sh. Remove it only after a production release with signed macOS binaries and signed/notarized PKGs has shipped and fresh install/upgrade paths are verified.

Validation

• cargo fmt
• task test TEST_FILTER=package_setup CARGO_TEST_ARGS="--lib"
• task build
• bash -n packaging/debian/build-deb.sh packaging/macos/build-pkg.sh packaging/homebrew/update-formula.sh packaging/debian/postinst packaging/debian/prerm packaging/macos/scripts/postinstall packaging/macos/scripts/preinstall
• YAML parse via python3/PyYAML
• local deb smoke build from target/debug/git-ai
• Homebrew formula render smoke test
• task lint

---

fixes PD-10
followup #1322

[Siddhant-K-code]

Closed as stale because GitHub kept the old head branch name after the branch was renamed. The replacement PR from SK/signed-package-installers is #1714.

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🟡 Help text shows install-hooks options under the wrong command

The new setup-package line is inserted between install-hooks and its sub-options (eprintln!(" setup-package ...") at src/commands/git_ai_handlers.rs:379), so --skills and --visual-studio-extension now visually appear as options of setup-package instead of install-hooks.

Impact: Users reading the help output will think --skills and --visual-studio-extension belong to setup-package (which actually rejects them as unknown options), rather than to install-hooks where they belong.

Help text ordering before and after the change

Before:

  install-hooks      Install git hooks for AI authorship tracking
    --skills               Also install agent skill files
    --visual-studio-extension
                           Also install the Visual Studio extension on Windows
  uninstall-hooks    Remove git-ai hooks from all detected tools

After (broken):

  install-hooks      Install git hooks for AI authorship tracking
  setup-package      Complete per-user setup after a package-manager install
    --skills               Also install agent skill files
    --visual-studio-extension
                           Also install the Visual Studio extension on Windows
  uninstall-hooks    Remove git-ai hooks from all detected tools

The indented --skills and --visual-studio-extension lines at src/commands/git_ai_handlers.rs:380-382 were originally directly below install-hooks (line 378). The new setup-package line (379) was inserted between them, breaking the visual grouping. If a user runs git-ai setup-package --skills, the parse_options function at src/commands/package_setup.rs:85-87 returns an error: "unknown setup-package option: --skills".

Suggested change

	eprintln!(" setup-package Complete per-user setup after a package-manager install");
	eprintln!(" --skills Also install agent skill files");
	eprintln!(" --visual-studio-extension");
	eprintln!(" Also install the Visual Studio extension on Windows");
	eprintln!(" setup-package Complete per-user setup after a package-manager install");

---

Was this helpful? React with 👍 or 👎 to provide feedback.