RC8 cut: тег v1.0.0-rc.8

## Что это ## Резюме (RU) RC8 cut: тег v1.0.0-rc.8 — описание + 11 gates верификации (PR #294) *Полный перевод тела — в работе. Английский оригинал ниже.* --- # Original (EN) ## Objective Tag `v1.0.0-rc.8` from `origin/main` at HEAD, cut window 2026-05-21. Capture the full RC8 narrative, verification gates, and P0 blockers for the eighth release candidate in the 1.0.0 sequence. ## Source Links * **PR #294**: [https://github.com/agisota/rox.one/pull/294]() (`chore/rc8-narrative-2026-05-20`) * **Source plan**: `docs/release/rc8-cut-plan-2026-05-20.md` on `chore/rc8-narrative-2026-05-20` * **Supersedes**: PZD-54 (overwritten by parallel agent on 2026-05-20) ## Current State RC7 tagged at `3dcdf109` on 2026-05-17. Seven PRs merged to main since RC7. Three P0 blockers (B-CI-1, B-REPRO-2, B-SIGN-3) identified by 2026-05-20 PR #268 audit. RC8 cut window: 2026-05-21. ## Requirements * Close P0 blockers B-CI-1, B-REPRO-2 (optional/defer), B-SIGN-3 before tagging * All 11 verification gates must pass * PR #272 (CVE-2026-45736 ws security fix) recommended for inclusion * macOS Ventura officially dropped (Sonoma 14+ floor, PR #274) ## Specification ### What's in RC8 (since RC7 `3dcdf109`) | \# | PR | Title | Impact | | -- | -- | -- | -- | | 1 | #265 | feat(linux): DEB + RPM packages alongside AppImage | new artifacts | | 2 | #267 | feat(nixos): flake with FHS wrapper for AppImage | new platform | | 3 | #268 | feat(design): integrate ROX Design (embed) + 7 follow-up fixes | new feature | | 4 | #274 | chore(mac): drop Ventura support, Sonoma 14+ floor | **breaking** | | 5 | #276 | feat(win): self-signed codesign generator + install instructions | new tooling | | 6 | #277 | chore(ci): add cache@v4 to release/build workflows | CI hygiene | | 7 | #279 | feat(ci): multi-platform on-merge pipeline + R2 mirror + nightly cleanup | release infra | ### P0 Blockers **B-CI-1** — signed-release workflows bypass `rox-design:payload:verify` gate. Fix: hoist verify into `apps/electron/scripts/beforeBuild.cjs` + prepend explicit step in 5 workflow files. **B-REPRO-2** — non-reproducible payload preparation (host-local `/Applications/Open Design.app/`, no SHA-256 pinning). Fix: `--from-archive` mode with pinned tarball. Recommended: defer to RC9. **B-SIGN-3** — nested Mach-O `node` binary lacks `mac.binaries`/`signIgnore`; notarization will reject. Fix: add to `electron-builder.yml` `mac.binaries`. ## Acceptance C... ## Статус Это задача из текущего backlog'а ROX.ONE (Linear). Текущий статус в Linear: `На ревью — In Review`. Метки: `Улучшение` / `Improvement`, `Фича` / `Feature`. ## 🔗 Linear - [PZD-86](https://linear.app/kuhjie/issue/PZD-86/rc8-cut-teg-v100-rc8-opisanie-11-gates-verifikacii-pr-294-rc8-cut-tag) — backing ticket - Parent epic: [PZD-119](https://linear.app/kuhjie/issue/PZD-119)