Purpose: execute docs/release-checklist.md end to end — from the split
public history to an announced, signed, notarised stable bundle — so the
first official release exists only when every step can fail on its own.
The checklist is the runbook; this epic tracks it and keeps the canary
channel honest as the dress rehearsal.

• ADR-0125: an official release exists only on a v-tag; canary is the dress rehearsal, not gated on this list
• ADR-0109: two bundles, each with its own bundle ID, profile and update channel; stable carries com.thezer0.browser
• ADR-0105: Developer ID Application certificate under Team ID 24X5CQGA86 present and verifiable
• ADR-0108: steps 1–2 (signed bundle) close with this release; the 1Password chain question lands in E4/E7
• ADR-0005: the bundle embeds WebKit at the tag pinned in scripts/webkit/version.txt (lock paid in E7)
• docs/release-checklist.md §1: split history pushed; ./scripts/check.sh green on the tree that will be tagged
• docs/licensing.md §6: the LGPL source-offer artefact ships in the release zip

Children are the issues listing this one as Part of.