[ai-assisted] fix(mas): add app-sandbox to child entitlements

Co-Authored-By: Claude <noreply@anthropic.com>

Author: JooHyung Park

entitlements.child.plist

@@ -2,9 +2,10 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-    <!-- Child helpers must inherit sandbox from parent.
-         Do NOT declare app-sandbox again here, or helpers can crash with
-         forbidden-sandbox-reinit in MAS/TestFlight builds. -->
+    <!-- Mac App Store requires explicit app-sandbox declaration
+         even for child helpers. We include both app-sandbox and inherit. -->
+    <key>com.apple.security.app-sandbox</key>
+    <true/>
     <key>com.apple.security.inherit</key>
     <true/>
 </dict>

forge.config.ts

@@ -123,6 +123,18 @@ const config: ForgeConfig = {
             { stdio: 'inherit' }
           );
           console.log(`[postPackage] ✅ Successfully re-signed: ${helperApp}`);
+
+          // Verify the entitlements were applied
+          try {
+            const verifyOutput = execSync(
+              `codesign -d --entitlements - "${helperPath}" 2>&1`,
+              { encoding: 'utf8' }
+            );
+            console.log(`[postPackage] Verifying entitlements for ${helperApp}:`);
+            console.log(verifyOutput);
+          } catch (verifyError) {
+            console.error(`[postPackage] ⚠️  Failed to verify entitlements for ${helperApp}:`, verifyError);
+          }
         } catch (error) {
           console.error(`[postPackage] ❌ Failed to re-sign ${helperApp}:`, error);
           throw error;