[GCWing]

Summary

• Use the official repository ID for Desktop release protection, updater mirror routing, the mirror webhook, and Nightly cache writes. Publish new Relay images under the current owner with OCI labels pointing to the publishing repository.
• Validate the staged Relay descriptor before making the Release public. Official recovery can reuse trusted pre-transfer descriptors. Verify public downloads against the exact descriptor and signature from the build.
• Point Desktop, CLI, SSH dispatch, and the mirror at openBitFun/OpenBitFun. Keep both official Relay namespaces readable, preserve signed descriptor bytes and pinned legacy update feeds, and recover the Windows updater format from the original release source.
• Make the CLI workflow's Homebrew tap configurable and keep the original destination for token-only configurations.

Verification

AI-assisted. Tested with focused release, workflow, mirror, and deployment fixtures.

• pnpm run check:github-config and pnpm run check:repo-hygiene
• pnpm run test:release-packaging
• node --test scripts/relay/package-contract.test.mjs scripts/linux-binaries-manifest.test.mjs scripts/relay/source-build.test.mjs scripts/updater-maintenance.test.mjs
• cargo test --locked -p openbitfun-services-integrations --no-default-features --features remote-ssh-concrete --lib remote_ssh::dispatch_ssh::tests::latest_cli_sources_are_github_then_the_versioned_openbitfun_mirror
• cargo test --locked -p openbitfun-cli --bin openbitfun self_update::tests (12 passed)
• bash -n on the changed shell scripts, git diff --check, and the Git object size check
• Read back the current stable manifest from both GitHub URLs. Confirmed that the existing release is still v1.0.10 and the legacy feed fixtures and version metadata are byte-for-byte unchanged.

Local platform-specific skips remain covered by CI. SSH dispatch resource selection ran with fixtures. Live SSH workspace, Remote Connect, Peer Device Mode, and Detached Dispatch were outside this verification.

Rollout

Use the updated mirror script from the production checkout before the first release in the organization namespace. The new GHCR path currently returns 403 for anonymous token requests. Confirm the organization package is public and allows Actions writes, and keep the old package readable for published descriptors. The workflow retains its anonymous pull gate. This PR leaves version numbers and tags untouched and does not start a release workflow.