fix(build): resolve macOS packaging and installation failures

- Include target/release/libcodex_ffi.dylib in FFI framework search paths
- Embed libcodex_ffi.dylib directly into the macOS app bundle during packaging
- Embed xworkmate-go-core for non-App-Store local builds
- Ad-hoc re-sign the app bundle after modifying its contents
- Fix DMG path resolution in the installation script to handle filenames with spaces

scripts/copy_ffi_framework.sh

@@ -12,6 +12,7 @@ RUST_DIR="$PROJECT_ROOT/rust"
 # Source FFI library location
 UNIVERSAL_LIB="$RUST_DIR/target/universal/libcodex_ffi.dylib"
 ARM_LIB="$RUST_DIR/target/aarch64-apple-darwin/release/libcodex_ffi.dylib"
+RELEASE_LIB="$RUST_DIR/target/release/libcodex_ffi.dylib"
 DEBUG_LIB="$RUST_DIR/target/debug/libcodex_ffi.dylib"
 
 # Ensure Frameworks directory exists
@@ -24,6 +25,9 @@ if [[ -f "$UNIVERSAL_LIB" ]]; then
 elif [[ -f "$ARM_LIB" ]]; then
     echo "Copying arm64 FFI library..."
     cp "$ARM_LIB" "$FRAMEWORKS_DIR/"
+elif [[ -f "$RELEASE_LIB" ]]; then
+    echo "Copying release FFI library..."
+    cp "$RELEASE_LIB" "$FRAMEWORKS_DIR/"
 elif [[ -f "$DEBUG_LIB" ]]; then
     echo "Copying debug FFI library..."
     cp "$DEBUG_LIB" "$FRAMEWORKS_DIR/"
@@ -32,6 +36,7 @@ else
     echo "Expected one of:"
     echo "  - $UNIVERSAL_LIB"
     echo "  - $ARM_LIB"
+    echo "  - $RELEASE_LIB"
     echo "  - $DEBUG_LIB"
     exit 0  # Don't fail the build if library doesn't exist yet
 fi

scripts/install-flutter-mac-dmg.sh

@@ -54,9 +54,8 @@ if [[ -z "$DMG_PATH" ]]; then
     echo "No DMG found under $DIST_DIR for $APP_NAME" >&2
     exit 1
   fi
-  IFS=$'\n' dmgs=($(ls -t "${dmgs[@]}"))
-  unset IFS
-  DMG_PATH="${dmgs[0]}"
+  # Sort by modification time and pick the newest
+  DMG_PATH="$(ls -t "${dmgs[@]}" | head -n 1)"
 fi
 
 if [[ ! -f "$DMG_PATH" ]]; then

scripts/package-flutter-mac-app.sh

@@ -102,6 +102,27 @@ if [[ ! -d "$BUILD_APP_PATH" ]]; then
   exit 1
 fi
 
+# Ensure FFI library is embedded if it was copied to macos/Frameworks
+SOURCE_FFI_LIB="$ROOT_DIR/macos/Frameworks/libcodex_ffi.dylib"
+TARGET_FFI_LIB="$BUILD_APP_PATH/Contents/Frameworks/libcodex_ffi.dylib"
+if [[ -f "$SOURCE_FFI_LIB" ]]; then
+  echo "Embedding FFI library into app bundle..."
+  mkdir -p "$(dirname "$TARGET_FFI_LIB")"
+  cp "$SOURCE_FFI_LIB" "$TARGET_FFI_LIB"
+fi
+
+# Embed xworkmate-go-core for local/non-App-Store builds if available
+if [[ "${XWORKMATE_APP_STORE:-}" != "true" ]]; then
+  SOURCE_GO_CORE="$ROOT_DIR/build/bin/xworkmate-go-core"
+  # lib/runtime/go_core.dart expects it under build/bin relative to one of the roots
+  TARGET_GO_CORE="$BUILD_APP_PATH/Contents/MacOS/build/bin/xworkmate-go-core"
+  if [[ -f "$SOURCE_GO_CORE" ]]; then
+    echo "Embedding xworkmate-go-core into app bundle..."
+    mkdir -p "$(dirname "$TARGET_GO_CORE")"
+    cp "$SOURCE_GO_CORE" "$TARGET_GO_CORE"
+  fi
+fi
+
 verify_bundle_signature() {
   local app_path="$1"
   echo "Verifying code signature: $app_path"
@@ -125,7 +146,10 @@ if [[ -n "$SIGN_IDENTITY" ]]; then
     --preserve-metadata=entitlements,requirements,flags,runtime \
     --timestamp=none "$DIST_APP_PATH"
 else
-  echo "Preserving Flutter build output signature."
+  echo "Ad-hoc re-signing app bundle to account for manual additions..."
+  codesign --force --deep --sign - \
+    --preserve-metadata=entitlements,requirements,flags,runtime \
+    --timestamp=none "$DIST_APP_PATH"
 fi
 
 verify_bundle_signature "$DIST_APP_PATH"