Sail Manifest: the macOS release that passes CI but still breaks

Field notes

The checker accepts a DMG and optional appcast, archive, and previous-build inputs, then returns a release-gating exit code rather than modifying the artifact. Its checks extend from code signing and Gatekeeper through Sparkle enclosure bytes, public-key presence, dSYM UUIDs, architectures, deployment targets, and credential-shaped files. The example distinguishes an app with a stapled ticket from an unstapled disk image, a failure that can block downloads despite a valid application bundle.