Fix ad-hoc macOS publishing

clients/apple/publish-macos.sh

@@ -19,7 +19,16 @@ if [[ ${1:-} == "--dry-run" ]]; then
   dry_run=1
 fi
 
-"$dotnet_host" publish "$project" -c "$configuration" --no-restore -p:ArchiveOnBuild=false
+publish_properties=(-p:ArchiveOnBuild=false)
+if (( dry_run )); then
+  # Hardened-runtime library validation requires the executable and every bundled dylib to
+  # have the same real Team ID. Ad-hoc signatures have no Team ID, so a hardened ad-hoc app
+  # passes codesign verification but is rejected by dyld at launch. Keep local validation
+  # ad-hoc and reserve the hardened runtime for the Developer ID distribution path below.
+  publish_properties+=(-p:UseHardenedRuntime=false)
+fi
+
+"$dotnet_host" publish "$project" -c "$configuration" --no-restore "${publish_properties[@]}"
 built_app="$script_dir/VoiceCat.Mac/bin/Release/net10.0-macos27.0/osx-arm64/VoiceCat.app"
 if [[ ! -d "$built_app" ]]; then
   print -u2 "VoiceCat.app was not produced at $built_app"
@@ -37,8 +46,7 @@ mkdir -p "$distribution"
 ditto "$built_app" "$app"
 
 if (( dry_run )); then
-  # The workload may preserve mixed ad-hoc signatures on nested runtime dylibs. Re-sign the
-  # complete local bundle as one ad-hoc unit so hardened-runtime Team-ID checks are meaningful.
+  # Normalize the workload's mixed nested signatures after bundling.
   codesign --force --deep --sign - "$app"
   codesign --verify --deep --strict "$app"
   spctl --assess --type execute "$app" 2>/dev/null || true