fix(codesign): sign bundles with spaced paths; fail loudly on signing errors

[sepehr-safari]

Summary

native package --signing adhoc|identity silently shipped an unsigned macOS bundle when the output path contained spaces (e.g. My App.app). The command exited 0, so a release built this way was broken with no error surfaced — on Apple silicon the unsigned bundle fails codesign --verify and does not launch cleanly.

Fixes #115.

Root cause

src/tooling/codesign.zig composed the codesign invocation as a shell string run via sh -c, with the bundle path concatenated unquoted. A spaced path word-split (…/My App.app → …/My, App.app), so codesign errored with …/My: No such file or directory. runSigning() in src/tooling/package.zig then swallowed the failure — it noted the unsigned state in signing-plan.txt and returned normally, so native package still exited 0.

Fix

• Argv, not sh -c. codesign / notarytool / stapler / ditto are now built as argv arrays and spawned directly (matching the existing src/tooling/ios.zig idiom). Passing argv straight to the OS keeps a spaced path a single argument and removes the shell command-injection surface from paths and identities.
• Fail loudly. When signing was requested and codesign actually ran and failed — or --signing identity is given no --identity — packaging now records the unsigned state and exits non-zero with a clear message, instead of shipping a broken bundle silently. A host that genuinely cannot sign (cross-packaging a macOS bundle off macOS, where codesign does not exist) stays tolerant and still succeeds with an unsigned bundle.
• Regression gate. test-package-signing now packages to a spaced output path, so the exact scenario is covered end to end. New argv unit tests pin spaced paths as single arguments.

Verification

• zig build test — full suite green.
• scripts/gate.sh fast — all affected suites green.
• zig build test-package-signing (now a spaced path) — codesign --verify --strict --deep passes; signature is flags=0x2(adhoc) (a real bundle seal, not the previous 0x20002(adhoc,linker-signed)).
• Manual end-to-end on macOS/arm64:
  • package --signing adhoc --output "…/My App.app" → exit 0, verify passes.
  • bogus --identity (codesign runs & fails) → exit 1 + clear message.
  • --signing identity with no --identity → exit 1 + clear message.
  • --signing none → exit 0 (unchanged).

Changelog

Adds a fix: fragment under changelog.d/.

[vercel]

@sepehr-safari is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.