Aligns with the chip-plugin repos:
- Use TAG (with v prefix) for gh release create, VER (stripped) for
Changelist lookup and upload.php's version field.
- curl --fail-with-body so server-side errors fail the workflow instead of
passing silently.
- Switch GH_TOKEN to the auto-provided GITHUB_TOKEN with explicit
contents:write permission, dropping the dependency on a per-repo
ACCESS_TOKEN PAT.
- Bump VERSION
- Add 'Created installers' entry to Changelist.txt
- release.sh now uses the new upload.php URL with plugin/version/changelog
form fields, replacing the old set.php endpoint
`security find-identity -v` was intermittently not seeing the imported
Developer ID Installer cert on the GitHub Actions macos-latest runner,
causing the .pkg to ship unsigned and Apple notary to reject it. Gate the
codesign / productsign branches on the env-var presence (which is what the
keychain bootstrap already gated on) instead.
Also surface notary rejection details on failure via `xcrun notarytool log`.
gin's loadDirectory() doesn't recurse, and the legacy BinaryData flow stored
presets flat in the user dir. Installer/build.sh now stages a flat copy under
Installer/_flat_presets/ which the Inno Setup script and macOS pkg both
consume; CMakeLists installs the same flat set on Linux.
Replaces the zip-based ci/build.sh flow with installer outputs (Inno Setup
on Windows, productbuild on macOS, cpack DEB on Linux) signed via Microsoft
Trusted Signing on Windows and Apple Developer ID on macOS.
Plugin code: factory wavetables and presets now ship as files via the
installer rather than embedded BinaryData. PluginProcessor implements
getProgramDirectory/getFactoryProgramDirectories so gin scans factory
content from systemResourceRoot. First-run migration copies any presets
from the legacy com.socalabs/Wavetable/programs path into the new user
dir under Library/Audio/Presets/SocaLabs/Wavetable.
Bumps gin submodule to match Identity for getFactoryProgramDirectories
support.
