State per-platform signing, and give search results the brand and prose they quote

[yujiezhang-ops]

Three changes that were developed and verified together on one tree. Each commit is a self-contained logical change and green by construction; the head commit carries the full gate results below.

1. DeepSeek Harness mark (3bdb3f0)

Bundles lobe-icons' deepseek.svg (MIT) for the dsh planned-agent entry, with its rights record and digest like every other mark, and adds it to the dark-scheme inversion set and the e2e mark inventory.

2. Search results: brand and prose (3eaaa57)

Google indexes the home page with no usable summary, and Bing quotes demo-console fragments as the snippet (开始激活演示 0.6.2 · 未签名技术…, from a ~5-day-old crawl). The head tags were fine — the body was the problem: ~85% of the home page's visible text was the activation demo's interface labels, and the description described a flow without naming anything it operates on.

• data-nosnippet on the demo console — it is a replica of the product UI, not prose about it. Still crawled and indexed; just not quotable as the page's summary. Snippet-eligible text drops from 3,144 to 1,458 chars, all of it real prose. (The attribute is Google-only; Bing is carried by the description and hero changes.)
• Descriptions now name what a query would: the agents (Claude Code, Codex, OpenCode), the protocols (OpenAI / Anthropic-compatible), and where keys live.
• The hero drops the channel/version note — the signing status was the loudest claim on every crawl, and /downloads/ + /security/ state it in full. The footer's raw channel slug becomes a link to /security/.
• A brand lockup leads the hero; JSON-LD becomes an @graph whose Organization carries the 1024px logo (the property search engines read for the brand image beside a result — neither og:image nor the favicon is consulted for it), plus an apple-touch-icon.
• Chrome CTA: 下载预览版 → 下载 BootAgent. A button on every page had made "preview" the loudest word about the product.

After merge, both engines need a recrawl: Search Console and Bing Webmaster Tools each have a request-indexing action; Bing also honours IndexNow.

3. Per-platform signing copy (e281cae)

v0.7.0's macOS artifacts are signed and notarised (upstream BootAgent#199 moved signing into the release workflow), so the blanket "unsigned technical preview" is now wrong for macOS while still right for Windows. Verified against the published artifacts before any copy changed:

codesign -dv  → Developer ID Application: steve li (F2VC757B28),
                hardened runtime, Notarization Ticket=stapled   (both DMGs)
spctl -t exec → accepted, source=Notarized Developer ID
stapler       → ticket valid
PE parse      → Windows installers: no Authenticode certificate table

• release-channel.ts models signing per target (notarized / signed / unsigned / not-applicable), driven by a hand-verified version floor whose evidence lives in a comment next to the constant. The feed records nothing about signing, so the floor is the only claim; Stable still requires the explicit tag marker.
• The download page states signing per platform, and drops the "原生构建 + cleanroom 通过" row — it was rendered unconditionally while the channel reports cleanroom as not-recorded, exactly the kind of unearned badge this repo's release-channel module exists to prevent.
• The security page names the Team ID and the spctl command a reader can run, and prints the channel id from the channel object rather than a hardcoded literal.
• The quickstart's four-step Gatekeeper bypass comes down, honouring its own sunset clause ("签名与公证完成后，上面四步都不再需要，届时这份指南也会撤下"). The #macos-gatekeeper anchor stays for inbound links; readers on v0.6.x are told to upgrade rather than taught an allowance for an unsigned build. The screenshots, their rights records and the NOTICE paragraph go with it.
• Help (install / upgrade / troubleshooting, both locales), llms.txt (also fixes the stale "No release has been published yet") and the changelog say the same thing in their registers.

Test plan

• pnpm test — 98 passed (9 files). Down from 103 on main by design: −8 digest tests for the four removed screenshots, +3 new signing-floor tests (notarized ≥ 0.7.0, unsigned < 0.7.0, numeric-not-lexicographic version compare).
• pnpm run build — astro check 0 errors, 51 pages validated.
• pnpm run test:e2e with GITHUB_TOKEN — 216 passed, 18 skipped, matching main's healthy baseline. (Unauthenticated runs skip 15 download-page tests silently — run with a token.)
• Built HTML inspected: per-platform signing values in the download grid, technical-preview + Team ID + spctl command on /security/, zero guide-steps remnants, JSON-LD @graph with Organization logo.
• Signing verified by hand on both v0.7.0 DMGs and both Windows installers, as above.

🤖 Generated with Claude Code

[yujiezhang-ops]

Adversarial review (fresh-context pass over origin/main...HEAD)

P0: none. P1: none. The signing model's version comparison, the removed-field sweep, anchors, e2e string assertions, the dark-scheme mark inventory, JSON-LD structure and zh/en parity all checked clean. Findings below, with disposition; everything marked fixed landed in 7a27596 and the gates re-ran green (vitest 98, build 51 pages, affected e2e).

P2 — fixed

1. DownloadSelector.astro — the signing notice was a constant beside a per-target signing row. A pre-0.7.0 feed (rollback, or a RELEASE_REPOSITORY fork shipping unsigned builds) would have rendered "signed and notarised" next to "签名状态：未签名". The notice now branches on the same signing state the row reads. The en security-page description similarly promised "how to verify the release signature" while the command block is conditional; it now says "where each platform stands on signing".
2. NOTICE — made false by this branch. It still said nothing on the site references bootagent-logo.png directly, while the new JSON-LD names it as the Organization logo on every page. Corrected.

P3 — fixed

3. e2e/site.spec.ts comment claiming planned-agents.json "is legitimately empty today" (stale since the dsh commit).
4. asset-rights.test.ts comment citing the NOTICE paragraph this branch removed.
5. docs/verification-checklist.md describing the now-empty guide manifest as recording screenshot contents.
6. docs/rename-to-bootagent.md still listing "retake the Gatekeeper screenshots" as pending — resolved differently (guide came down with v0.7.0's signed builds).
7. global.css hero-stagger comment describing delays that no longer match the values.
8. llms.txt translation list missing /en/help/ (pre-existing, one line, file already touched here).
9. en site.description dropped the backup claim the Chinese one makes ("自动备份") — now "backs up existing config before writing anything".

P3 — noted, deliberately not fixed here

• Same-package copy contradiction (pre-existing): /security/ says the same build ships via "官网、GitHub Release、网盘、企业云盘" while /downloads/ says artifacts ship through GitHub Releases only. This branch increases /security/'s exposure (the footer now links it), so worth its own focused change.
• sameAs and Organization url in JSON-LD hardcode the canonical repo and ignore BASE_PATH respectively — only wrong for forks or non-root deploys, neither of which this site does today.
• og:image dimensions are constants for the default image (verified 1215×690); the comment already flags the debt if a page ever passes its own image.
• Planned targets get a computed signing even with no asset; if a future ≥0.7.0 release shipped without macOS artifacts, /security/ would still describe macOS as notarised. Speculative today (v0.7.0 ships all platforms).

Verified clean (highlights)

• versionAtLeast: numeric per-segment ("0.10.0" > "0.7.0"), missing segments zero-filled, v stripped at the sole call site; all four new floor tests bind.
• Zero survivors of unsigned/technical-preview-unsigned/未签名技术预览版 outside Windows-current, v0.6.x-historical, conditional-fallback and fixture contexts.
• #macos-gatekeeper resolves in both locales via <base> (zh) and localePath (en); no dead references to the four deleted screenshots; the empty guide manifest is still guarded bidirectionally by asset-rights.test.ts.
• Every exact-match e2e string exists verbatim in the corresponding source.

🤖 Generated with Claude Code

[yujiezhang-ops]

Two updates since the review comment above:

7a27596 applies the review findings — both P2s (the download notice now branches on the same per-target signing state as the signing row; NOTICE's logo sentence corrected) and the seven fixable P3s. Gates re-ran green.

a2e2dc5 adds a zero-decision download path, modelled on ccswitch.io/zh/download's lead: one primary button above the platform picker carrying the detected target's file, restating version · target · size · signing beside it, following the picker's selection, hiding when a target has no artifact. Plus a "past versions → GitHub Releases" line. Deliberately not copied from the reference: truncated checksums (the full digest is this site's claim), a brew line (no formula exists), and hero download buttons on the home page (its one-activation-entry rule is e2e-guarded by design).

Full gates on the final tree: vitest 98 passed, build 51 pages validated, e2e 216 passed / 18 skipped (baseline-identical), verified interactively in the browser across light/dark and mobile.

🤖 Generated with Claude Code

[yujiezhang-ops]

Note: this merged while two follow-up commits were in flight (the review fixes and the zero-decision download button). They continue in #33, cherry-picked onto the squash — applied clean, full gates green there. 🤖