docs(pointer): surface artifact-bound evidence in audit

[rogu3bear]

Summary

• make the North Star audit checklist explicitly name artifact-bound human release evidence
• call out that final manual evidence must match the same DMG digest, commit, release tag, mounted app identity, app version/build, and executable SHA-256
• cover the stricter audit checklist in IdentityTests

Scope

• original macOS app North Star audit only
• no website surface
• no public distribution metadata

Verification

• swift test --package-path apps/macos --filter IdentityTests/testNorthStarAuditGateBuildsPromptToArtifactChecklist
• make -C apps/macos north-star-audit NOTARY_PROFILE="notarization" (expected failure after printing the stricter checklist and passing app/root guards)
• swift test --package-path apps/macos
• ./scripts/check-monorepo-references.sh && ./scripts/check-website-boundary.sh && ./scripts/check-distribution-boundary.sh && ./scripts/check-compatibility-boundary.sh && ./scripts/check-local-first.sh && ./scripts/check-app-ui-contract.sh
• git diff --check

Known Remaining Release Blockers

• notarization profile credentials are still required
• signed DMG still needs notarization and stapling
• Gatekeeper acceptance must pass for app and DMG
• stable release metadata and final manual evidence must be produced only after the Gatekeeper-accepted candidate exists

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/macos/Scripts/north-star-audit.sh - 0 issues
• apps/macos/Tests/PointerDesignerTests/IdentityTests.swift - 0 issues

---

_{Reviewed by grok-code-fast-1:optimized:free · 98,776 tokens}