[knqiufan]

Which issue or RFC does this PR close?

Refs #2112 (09-B). Consumes the candidate handoff from #2475 (09-A) and the final platform resources and acceptance from 09-C, #2108, and #2109. #2112 stays open for real release acceptance.

Rationale for this change

An unsigned Actions candidate cannot establish that the final installer or runtime is supported. Desktop needs a separate publication path that retains the exact signed, accepted bytes and verifies what users can actually download.

What changes are included in this PR?

• Add an explicit dispatch from protected upstream master, a read-only preflight, and a writer gated by an independently reviewed desktop-release environment.
• Bind the protected tag, Desktop and Server source commits, the original 09-A manifest and candidate digests, the exact qualified Server wheel/operation contract, and final installer, catalog and Ops digests to per-platform evidence. Windows x64 and both macOS architectures are required; Linux is optional and needs its own qualified producer output.
• Fill a draft idempotently, reject conflicting uploaded files, and open a prerelease only when the complete inventory matches. Download each public asset into a clean directory without credentials and check size and SHA-256. A separate approved promotion requires downloaded-installer provisioning evidence and repeats public verification.
• Add English and Chinese maintainer instructions and local HTTP tests. Python release automation is unchanged.
• Restore the missing Apache license header on the Gateway lifecycle module so the repository-wide CI preflight can run.

The branch is rebased on 69b2d7e2, which includes #2475, the updated SeekDB migration step budget, and the equivalent OceanBase acceptance timeout fixes. Required checks and per-test deadlines remain enforced.

Are there any user-facing changes?

No current installation or API changes. A later Desktop release will advertise only its qualified targets and include exact manifests and checksums. Repository administrators still need to configure the protected environment/tag rules and platform maintainers must supply final signed assets and real-machine acceptance.

How was this change tested?

• On the rebased head, make check passed, as did 151 tests across tests/test_desktop_release_publication.py, tests/test_desktop_candidate.py, tests/test_ci_changes.py and tests/test_workflow_actions.py. The HTTP publication tests used a local fake service.
• Earlier validation exercised build(desktop): assemble versioned release candidates #2475's actual assemble and verify using its three synthetic native-leg fixtures, then passed the exact candidate bytes into the 09-B validator with independent Desktop and Server commits. Earlier make docs-test and scoped Open Code Review delegation also passed.
• The previous SeekDB 3.14 shard failed after approximately 25 minutes at its former step deadline; the rebased baseline increases that step to 40 minutes. The new Actions run must establish whether the complete backend suite passes.
• No real Release or dispatch, asset upload, platform signing, or secret configuration was performed. Fake HTTP tests do not qualify installers or the real prerelease workflow.

AI usage statement

OpenAI Codex assisted with implementation, tests, documentation, review, and the rebase.

[PsiACE]

LGTM, thanks!

[CLAassistant]

All committers have signed the CLA.

[hidb4ai]

Reviewed and rechecked commit 42f9e1ea4a8c6900d34d409b7fe1eb28cbc0fccf; there has been no new PR commit since the previous review.

The same content conflicts remain against current master (7c41a14fbd07944af9fd8eaf84e718002d0f5376) in .github/workflows/e2e-harness.yml and scripts/run_atomic_memory_clean_migration.py, reproduced again with git merge-tree --write-tree. Master provides --test-timeout, while this branch introduces --case-timeout for the same runner. Please reconcile the runner and all workflow callers when updating the branch, then rerun CI on the resulting head.

CI preflight and the Python 3.11–3.14 unit/E2E matrix now pass; other CI jobs and CLA are still pending. The merge-conflict blocker remains, so approval is still withheld.

[hireview001]

• Resolve merge conflicts with the target branch.

[hidb4ai]

Reviewed f302dfd4f8c421a1dafc0071c0fe073f4dd6e304. The previous merge conflicts are resolved against current master, and I found no remaining blocking correctness issues in the publication changes. No database schema or public product API is added; the new contracts are maintainer-facing release workflow inputs and artifact manifests.

Candidate-to-publication validation passed with synthetic handoff assets. Real signing, installed provisioning, and public release acceptance remain tracked in #2112.