fix(macos): bundle native icons with verified legacy fallback

[GCWing]

Summary

macOS packaging now includes a native Icon Composer catalog for macOS 26/27 and a verified ICNS fallback for development and older macOS releases. The modern source stays full bleed; the legacy export has its own authored transparent canvas and ten native representations.

Type and Areas

Type: bug fix, packaging, CI, dependency, docs.

Areas: Desktop/Tauri, Installer, brand resources, release and nightly workflows.

Motivation / Impact

• Preserve platform icon overlays when generating release configuration and applying the development configuration.
• Pin Tauri CLI to 2.11.4, require modern Apple asset tools for macOS bundles, and verify the catalog, Info.plist icon keys, and fallback bytes after packaging.
• Select Xcode 26.2 and exercise native bundling on both macOS packaging architectures.
• Keep normal asset generation reproducible from committed native exports and fail on stale source/output hashes. Windows/Linux/web/mobile artwork and the minimum supported macOS version stay unchanged.

Verification

Passed locally:

• pnpm run generate-brand-assets
• node --test scripts/generate-brand-assets.test.mjs scripts/macos-icon-bundle.test.mjs scripts/desktop-tauri-build.test.mjs — 46 passed, 1 skipped.
• pnpm run test:release-packaging — 79 passed, 1 skipped.
• pnpm run check:github-config — YAML validation and 29 tests passed; the PowerShell truth-table test was skipped because pwsh is unavailable locally.
• pnpm run check:repo-hygiene
• node scripts/check-git-object-sizes.mjs --base origin/main --head HEAD
• git diff --check

Apple iconutil decoding and actual legacy Tauri fixture bundling passed without launching UI. Full modern fixture bundling and the full Desktop/Installer build were not run locally because this Mac has Command Line Tools without full Xcode; the modified release/nightly workflows require the modern fixture on both macOS architectures. Automated resource checks do not establish visual Dock equivalence.

Reviewer Notes

AI-assisted; locally tested at the resource and packaging-contract level. No browser or computer-use validation was performed.

Remote workspace, remote control, Peer Device Mode, and Detached Dispatch were not exercised. This change is limited to host packaging and does not alter runtime commands, persisted data, or remote protocols.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.