feat(updates): enable Sparkle auto-update via GitHub Pages appcast

Point DOMAIN at the repo's GitHub Pages site (serves the gh-pages appcast.xml), enable SUEnableAutomaticChecks, and remove the in-tree appcast skeleton (feed is published out-of-tree). Ships an auto-updating build.

.gitignore

@@ -20,3 +20,6 @@ codesign.p12
 !/.claude/skills/
 /scripts/l10n/missing-translations.json
 /ai/output/
+# alt-tab-free [depaywall]: the Sparkle feed is published OUT OF TREE to the gh-pages branch by
+# scripts/update_appcast.sh; the in-tree appcast.xml is removed (PLAN §3.3).
+/appcast.xml

Info.plist

@@ -64,8 +64,8 @@
 	     Auto-checks stay off (below) until DOMAIN serves a real appcast host. -->
 	<string>1YfoCJDk/T8GQx1Gpf3O4ApFgDkBiN6oe/z/Kfnxs/M=</string>
 	<key>SUEnableAutomaticChecks</key>
-	<!-- alt-tab-free: off until DOMAIN serves a real appcast (avoids failed update checks). -->
+	<!-- alt-tab-free: enabled 2026-06-16 — DOMAIN serves the appcast on GitHub Pages (gh-pages). -->
-	<string>false</string>
+	<string>true</string>
 	<key>SUScheduledCheckInterval</key>
 	<string>604800</string>
 

appcast.xml

@@ -1,17 +0,0 @@
-<?xml version="1.0" standalone="yes"?>
-<!--
-  alt-tab-free [depaywall]: this in-tree appcast.xml has been TRUNCATED to an empty Sparkle feed
-  skeleton. The fork publishes its real Sparkle feed OUT OF TREE (the gh-pages branch) via
-  scripts/update_appcast.sh, so the live entries are NOT served from this tracked file (PLAN §3.3).
-
-  OWNER ACTION (before publish): `git rm appcast.xml` and add `/appcast.xml` to .gitignore (the
-  identity agent owns .gitignore). Serving the feed from the tree would (1) conflict on every
-  upstream + fork release and (2) re-introduce lwouis-key-signed entries the fork's SUPublicEDKey
-  cannot verify. It is left present-but-empty only so the tree stays buildable until removed.
--->
-<rss xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle" version="2.0">
-  <channel>
-    <title>alt-tab-free</title>
-    <language>en</language>
-  </channel>
-</rss>

config/local.xcconfig

@@ -30,16 +30,13 @@ PRODUCT_BUNDLE_IDENTIFIER = com.koftwentytwo.commandtabfree
 CURRENT_PROJECT_VERSION = 0.0.0
 
 // --- Hosts (overrides base.xcconfig :20-21) ---
-// OWNER-OVERRIDABLE-BEFORE-PUBLISH: fork-owned hosts.
+// DOMAIN serves the Sparkle appcast at https://<DOMAIN>/appcast.xml. Set 2026-06-16 to the repo's
-// TODO: replace fork.invalid with the fork's real web host. DOMAIN must serve
+// GitHub Pages site (gh-pages branch, published by scripts/update_appcast.sh). A kof22.com custom
-//       https://<DOMAIN>/appcast.xml (Sparkle feed) and /support, or update checks /
+// domain can be added later — GitHub redirects the github.io URL, so shipped builds keep updating.
-//       the in-app Support affordance 404. fork.invalid is a deliberately NON-routable
+// (/support still 404s here — harmless until a support page exists.)
-//       placeholder (RFC 6761 reserved .invalid TLD) so nothing phones home before publish.
+DOMAIN = koftwentytwo.github.io/CommandTabFree
-DOMAIN = fork.invalid
+// API_DOMAIN drives the user-feedback POST (FeedbackWindow) — left NON-routable: feedback is deferred
-// TODO: API_DOMAIN drives the user-feedback POST (FeedbackWindow). The activate
+// (§3.4). The activate fingerprint POST is closed separately at the handleCustomUrl handler.
-//       fingerprint POST is closed separately at the handleCustomUrl handler (§2/§3.4),
-//       so this may be made ROUTABLE for feedback without re-arming exfiltration.
-//       Decide feedback strategy at bootstrap (§3.4 option a/b/c).
 API_DOMAIN = fork.invalid/api
 
 // --- Code signing (overrides release.xcconfig :5) ---