The worker reads the newest release and download counts from GitHub's API, with an optional GITHUB_TOKEN secret for the rate limit. Download links go to GitHub's latest release, and the source link wears the GitHub mark. The "not notarized" notice goes: macOS builds are signed and notarized now. Co-Authored-By: Claude <noreply@anthropic.com>