test: prove validation ordering without startup timing (#736)

test: wait for guardian receipt completion

fix(release): drain remaining artifact inspection pipelines

Read inspector and archive output to EOF while preserving producer failures and first signing-identity selection. Exercise extended output through app signing, native-only validation, and DMG verification.

Allow cold video-encoder startup in the successful capture fixture without changing production deadlines or deadline-specific tests.

test(cli): remove Xcode 27 fixture warnings

fix(release): accept plain version changelog headings

Accept plain "## <version> - <date>" changelog headings in the release preflight alongside the bracketed form, so the dated 4.3.1 section is recognized. Adds parser coverage for both heading styles.

fix(release): omit filesystem metadata from app ZIPs

Use one production ZIP helper for app notarization, Sparkle and terminal packaging. Omit resource forks, extended attributes and quarantine instead of emitting __MACOSX AppleDouble entries outside the exact app root. Preserve strict validators and the terminal source metadata guard. Document the shared ownership boundary.

Real-producer regression: original command emitted15 outside-root entries among25 members; corrected archive has10 members and no metadata entries, preserving exact bytes, modes, links and source state. Existing validator tests and full signing-policy test passed. Repackaging the retained R7 app preserved its exact tree, all7 Foundation Mach-O signatures, online notarization, stapled ticket and Gatekeeper acceptance without launching it. Bash syntax, contextual ShellCheck, whitespace and scoped Codex P0 review passed. Native terminal-fixture provenance skips remain explicitly separate.

chore(release): prepare 4.2.2

fix(release): keep Finder metadata off app

fix(release): retry transient timestamp failures

release: publish Peekaboo 4.0.0

@steipete/peekaboo@4.0.0 is live on npm, so the source now claims a release
that exists. Restores the dated 4.0.0 changelog headings and shipped-tense
copy reverted by #372, and adds the signed 4.0.0 Sparkle appcast item.