feat(hololake): add explicit JD release activation operator

product-source/hololake-native-desktop/server/release-broadcast/README.md

@@ -14,3 +14,30 @@ service.
 The service listens only on `127.0.0.1`. Public HTTPS routing, updater trust-key
 provisioning, artifact upload, activation, and desktop rollout are independent
 deployment gates.
+
+`operator.mjs` supplies the separate, root-operated verification and activation
+boundary. `verify` reconstructs a private candidate tree and accepts it only when
+the broadcast, pipeline receipt, package bytes, Developer ID receipt, Apple
+notarization receipt, and exact human approval all agree. `activate` additionally
+requires the operator to repeat the expected release id, version, source commit,
+and broadcast SHA-256. It copies only referenced immutable artifacts, commits
+`ACTIVE.json` atomically, and reports that an explicit service restart is still
+required. It never uploads, activates, or restarts on its own.
+
+```text
+node operator.mjs verify \
+  --source /secure/release/out/0.2.0 \
+  --human-approval /secure/approvals/0.2.0.json
+
+sudo node operator.mjs activate \
+  --source /secure/release/out/0.2.0 \
+  --human-approval /secure/approvals/0.2.0.json \
+  --state-root /var/lib/guanghu/hololake-release-broadcast \
+  --expect-release-id GH-HOLOLAKE-RELEASE-0.2.0 \
+  --expect-version 0.2.0 \
+  --expect-source-commit 0000000000000000000000000000000000000000 \
+  --expect-broadcast-sha256 0000000000000000000000000000000000000000000000000000000000000000
+```
+
+The zeros above are placeholders, not deployable values. A real activation must
+use the exact facts printed by `verify` and a separately issued human approval.