P0: consume a self-contained Desktop Bridge payload

[100yenadmin]

Summary

Tracks #662 and implements the Workbench consumer/release-proof half of the approved pristine-Mac design. Depends on electricsheephq/evaos-desktop-bridge#311.

The customer-visible root cause is not a Mac Control redesign: release packaging could still fall back to a shell wrapper that searched for host Python/Homebrew, and raw Actions artifact transport loses executable modes. This branch makes release packaging accept only a self-contained, immutable Desktop Bridge payload while preserving the existing broker, Headscale, CUA-primary/Peekaboo-fallback, TCC, stop/revoke, kill-switch, diagnostics, app identity, update-channel, and no-ACP contracts.

What changed

• release packaging rejects the legacy host-Python bridge wrapper;
• consumes the producer payload through a fixed deterministic archive and two independent out-of-band SHA-256 pins;
• safely bounds/extracts the archive and rejects traversal, links, special files, duplicate paths, oversized members, and permission loss;
• validates exact producer source/toolchain/dependency/license identity, thin arm64 Mach-O shape, private runtime presence, payload digest/count, and complete signing-input closure;
• cross-links producer and Workbench manifests before packaging and in the final updater ZIP;
• verifies the root and every nested Mach-O against the expected Team ID after signing;
• extracts the exact updater ZIP on macOS and runs codesign --verify --deep --strict, while the release gate authenticates complete producer license coverage and required runtime shape;
• records the product-owner approval on the pristine-Mac design.

Validation

• focused Vitest: 3 files, 92 tests passed
• oxfmt --check — passed
• actionlint -shellcheck= for the three release workflows — passed
• Ruby YAML parse for the three release workflows — passed
• oxlint — 0 errors; 6 pre-existing warnings in the release-gate test file
• git diff --check and Node syntax checks — passed
• final adversarial review: no P0–P2 findings, 98% confidence

Explicit blocker / proof boundary

This PR is intentionally draft. It does not prove a real frozen payload, signed/notarized app, pristine-Mac setup, installed-app control, public distribution, or customer readiness.

Producer PR electricsheephq/evaos-desktop-bridge#311 remains blocked on a reviewed CPython runtime artifact/digest because python.org publishes Python 3.12.13 as source-only. This PR must not merge as a host-Python-removal claim until that producer artifact is built and pinned at current head.

No customer runtime, connector, grant, Tailscale/Headscale state, dashboard, release, or Matt setup was changed.

Follow-up sequence

1. P0: Workbench fresh-Mac onboarding depends on unbundled Python and manual private-network setup #662 PR C: typed bridge/private-network/action-engine prerequisite classification.
2. P0: Workbench fresh-Mac onboarding depends on unbundled Python and manual private-network setup #662 PR D: main-process guided install/open/enroll actions and localized UX.
3. P0: Workbench fresh-Mac onboarding depends on unbundled Python and manual private-network setup #662 PR E: clean-host and pristine supported-Mac proof.
4. P0: Mac & iPhone readiness can appear ready before end-to-end broker runtime control works #655: same-candidate exact-identity customer_mac_status, desktop_control_status, and desktop_see proof plus stop/revoke/kill-switch/offline/reboot gates.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 389b4b76-0776-44b2-ac4a-2f4703cd2fcb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/662-fresh-mac-onboarding

---

_{Comment @coderabbitai help to get the list of available commands.}

[100yenadmin]

Current-head CI update for 2708c321a:

• manually dispatched full PR Checks run (draft PRs skip the normal non-doc workflow): https://github.com/100yenadmin/evaOS-GUI/actions/runs/29190443105
• macOS unit tests: passed
• macOS arm64 build test: passed
• code quality: passed
• release script test: passed
• i18n: passed
• coverage: passed
• PR check plan: passed
• Windows lanes were intentionally skipped by the macOS-first plan

Proof boundary is unchanged: this is source/build CI, not a real producer payload, signed/notarized artifact, updater ZIP signature proof, pristine-Mac install, distribution, or customer readiness. PR remains draft and dependent on electricsheephq/evaos-desktop-bridge#311.