release: remove stale windows signatures before machine bundle

.codex/skills/release-check-out-pr/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: release-check-out-pr
+description: Check out a GitHub pull request for review in this repo, either in the current directory or in a new isolated worktree at ../yaak-worktrees/pr-<PR_NUMBER>. Use when asked to run or replace the old Claude check-out-pr command.
+---
+
+# Check Out PR
+
+Check out a PR by number and let the user choose between current-directory checkout and isolated worktree checkout.
+
+## Workflow
+
+1. Confirm `gh` CLI is available.
+2. If no PR number is provided, list open PRs (`gh pr list`) and ask the user to choose one.
+3. Read PR metadata:
+   - `gh pr view <PR_NUMBER> --json number,headRefName`
+4. Ask the user to choose:
+   - Option A: check out in the current directory
+   - Option B: create a new worktree at `../yaak-worktrees/pr-<PR_NUMBER>`
+
+## Option A: Current Directory
+
+1. Run:
+   - `gh pr checkout <PR_NUMBER>`
+2. Report the checked-out branch.
+
+## Option B: New Worktree
+
+1. Use path:
+   - `../yaak-worktrees/pr-<PR_NUMBER>`
+2. Create the worktree with a timeout of at least 5 minutes because checkout hooks run bootstrap.
+3. In the new worktree, run:
+   - `gh pr checkout <PR_NUMBER>`
+4. Report:
+   - Worktree path
+   - Assigned ports from `.env.local` if present
+   - How to start work:
+     - `cd ../yaak-worktrees/pr-<PR_NUMBER>`
+     - `npm run app-dev`
+   - How to remove when done:
+     - `git worktree remove ../yaak-worktrees/pr-<PR_NUMBER>`
+
+## Error Handling
+
+- If PR does not exist, show a clear error.
+- If worktree already exists, ask whether to reuse it or remove/recreate it.
+- If `gh` is missing, instruct the user to install/authenticate it.

.codex/skills/release-generate-release-notes/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: release-generate-release-notes
+description: Generate Yaak release notes from git history and PR metadata, including feedback links and full changelog compare links. Use when asked to run or replace the old Claude generate-release-notes command.
+---
+
+# Generate Release Notes
+
+Generate formatted markdown release notes for a Yaak tag.
+
+## Workflow
+
+1. Determine target tag.
+2. Determine previous comparable tag:
+   - Beta tag: compare against previous beta (if the root version is the same) or stable tag.
+   - Stable tag: compare against previous stable tag.
+3. Collect commits in range:
+   - `git log --oneline <prev_tag>..<target_tag>`
+4. For linked PRs, fetch metadata:
+   - `gh pr view <PR_NUMBER> --json number,title,body,author,url`
+5. Extract useful details:
+   - Feedback URLs (`feedback.yaak.app`)
+   - Plugin install links or other notable context
+6. Format notes using Yaak style:
+   - Changelog badge at top
+   - Bulleted items with PR links where available
+   - Feedback links where available
+   - Full changelog compare link at bottom
+
+## Formatting Rules
+
+- Wrap final notes in a markdown code fence.
+- Keep a blank line before and after the code fence.
+- Output the markdown code block last.
+- Do not append `by @gschier` for PRs authored by `@gschier`.
+
+## Release Creation Prompt
+
+After producing notes, ask whether to create a draft GitHub release.
+
+If confirmed and release does not yet exist, run:
+
+`gh release create <tag> --draft --prerelease --title "Release <version_without_v>" --notes '<release notes>'`
+
+If a draft release for the tag already exists, update it instead:
+
+`gh release edit <tag> --title "Release <version_without_v>" --notes-file <path_to_notes>`
+
+Use title format `Release <version_without_v>`, e.g. `v2026.2.1-beta.1` -> `Release 2026.2.1-beta.1`.

.codex/skills/worktree-management/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: worktree-management
+description: Manage Yaak git worktrees using the standard ../yaak-worktrees/<NAME> layout, including creation, removal, and expected automatic setup behavior and port assignments.
+---
+
+# Worktree Management
+
+Use the Yaak-standard worktree path layout and lifecycle commands.
+
+## Path Convention
+
+Always create worktrees under:
+
+`../yaak-worktrees/<NAME>`
+
+Examples:
+- `git worktree add ../yaak-worktrees/feature-auth`
+- `git worktree add ../yaak-worktrees/bugfix-login`
+- `git worktree add ../yaak-worktrees/refactor-api`
+
+## Automatic Setup After Checkout
+
+Project git hooks automatically:
+1. Create `.env.local` with unique `YAAK_DEV_PORT` and `YAAK_PLUGIN_MCP_SERVER_PORT`
+2. Copy gitignored editor config folders
+3. Run `npm install && npm run bootstrap`
+
+## Remove Worktree
+
+`git worktree remove ../yaak-worktrees/<NAME>`
+
+## Port Pattern
+
+- Main worktree: Vite `1420`, MCP `64343`
+- First extra worktree: `1421`, `64344`
+- Second extra worktree: `1422`, `64345`
+- Continue incrementally for additional worktrees

.github/workflows/release.yml

@@ -164,7 +164,10 @@ jobs:
           AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
           AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
         run: |
+          Get-ChildItem -Recurse -Path target -File -Filter "*.exe.sig" | Remove-Item -Force
           npx tauri bundle ${{ matrix.args }} --bundles nsis --config ./crates-tauri/yaak-app/tauri.release.conf.json --config '{"bundle":{"createUpdaterArtifacts":true,"windows":{"nsis":{"installMode":"perMachine"}}}}'
           $setup = Get-ChildItem -Recurse -Path target -Filter "*setup*.exe" | Select-Object -First 1
           $setupSig = "$($setup.FullName).sig"