Fix macOS publish bundle signing

clients/apple/publish-macos.sh

@@ -45,11 +45,39 @@ fi
 mkdir -p "$distribution"
 ditto "$built_app" "$app"
 
+entitlements="$script_dir/VoiceCat.Mac/VoiceCat.Mac.entitlements"
+
+sign_nested_code() {
+  local identity=$1
+  local timestamp_option=${2:-}
+  local runtime_option=${3:-}
+  local nested
+  local sign_options=(--force)
+
+  [[ -n "$timestamp_option" ]] && sign_options+=("$timestamp_option")
+  [[ -n "$runtime_option" ]] && sign_options+=("$runtime_option")
+
+  # Do not use codesign --deep for signing. It is intended as an emergency repair operation
+  # and can apply the app's entitlements to nested code. Sign each bundled Mach-O library first,
+  # then sign the outer app once with its own entitlements.
+  while IFS= read -r -d '' nested; do
+    codesign "${sign_options[@]}" --sign "$identity" "$nested"
+  done < <(find "$app/Contents" -type f \( -name '*.dylib' -o -name '*.so' \) -print0)
+}
+
+install_verified_primary_bundle() {
+  # dotnet publish must create the workload bundle before it can be normalized. Replace that
+  # misleading intermediate with the verified result so both documented output paths work.
+  rm -rf "$built_app"
+  ditto "$app" "$built_app"
+}
+
 if (( dry_run )); then
-  # Normalize the workload's mixed nested signatures after bundling.
-  codesign --force --deep --sign - "$app"
+  sign_nested_code -
+  codesign --force --entitlements "$entitlements" --sign - "$app"
   codesign --verify --deep --strict "$app"
   spctl --assess --type execute "$app" 2>/dev/null || true
+  install_verified_primary_bundle
   print "Validated ad-hoc build: $app"
   exit 0
 fi
@@ -60,10 +88,12 @@ if [[ -z "$identity" ]]; then
   exit 2
 fi
 
-codesign --force --deep --timestamp --options runtime \
-  --entitlements "$script_dir/VoiceCat.Mac/VoiceCat.Mac.entitlements" \
+sign_nested_code "$identity" --timestamp --options=runtime
+codesign --force --timestamp --options runtime \
+  --entitlements "$entitlements" \
   --sign "$identity" "$app"
 codesign --verify --deep --strict --verbose=2 "$app"
+install_verified_primary_bundle
 
 archive="$distribution/VoiceCat-macOS-arm64.zip"
 ditto -c -k --keepParent "$app" "$archive"