fix(release): the producer does not sign, and must not learn how

[stuffbucket]

This repository's producer is latently broken. It has not dispatched a build since macos-builder's producer isolation landed, so nothing has surfaced it here — but the next dispatch fails.

It was surfaced in stuffbucket/monimal, which carries a copy of this producer and hit it on its first real build (run 33566724936):

✖ Finalizing package [FAILED: No identity found for signing.]

Why

macos-builder now runs client build scripts with the signing keychain locked and SIGN_IDENTITY set to the ad-hoc identity "-". client/forge.config.ts gated osxSign on SIGN_IDENTITY being non-empty — and "-" is non-empty — so @electron/osx-sign resolves it through security find-identity, finds nothing, and dies.

What changes

Signing moves entirely to the builder. sign_walk = bun-runtime asks it to sign every nested code item deepest-first — the four Helper .apps and the Electron Framework included, each sealed as a bundle — then seal the outer bundle. sign_nested cannot express that: it takes regular files only.

The profile is still chosen by name, so this repo cannot widen what it is signed with, and clients/stuffbucket/maximal.policy already allows bun-runtime. No policy change.

• client/forge.config.ts loses the whole osxSign block — deleted, not re-gated. Under this contract a packager configured to sign fails, and that failure is the point.
• build.sh stops exporting MACOS_ENTITLEMENTS and no longer consumes SIGN_IDENTITY or ENTITLEMENTS_DIR.
• Its signing assertions are replaced by their inverse: a Developer ID signature on a producer-built bundle now fails, because that would mean the builder's keychain isolation had regressed.

A second, independent bug

PATH put /opt/homebrew/bin ahead of everything, so Homebrew's node beat the Node actions/setup-node installs. Measured on a developer Mac: node -v reported 24.19.0 while the script saw 26.5.0. On the builder that silently builds releases on an unpinned major. It's appended now.

Verified

Not on this repo — it has no local deps checked out and its CI will cover the TypeScript. The identical change was verified end to end in monimal: real producer, exit 0, version stamped into Info.plist, and the resulting DMG passing spctl as Notarized Developer ID with every Helper app and framework validating under codesign --verify --deep --strict.

shellcheck clean on build.sh.

Worth a follow-up

This repo pins .bun-version but has no .nvmrc, so nothing declares which Node it expects and nothing can assert it. monimal gained a gate gate for exactly this; here there is nothing to gate against.