fix(release): prevent the standalone macOS CLI sandbox crash

scripts/macos-release.test.tsadded+28-0

Changes to scripts/macos-release.test.ts

		@@ -0,0 +1,28 @@
	1	+import { expect, test } from 'bun:test'
	2	+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
	3	+import { tmpdir } from 'node:os'
	4	+import { join, resolve } from 'node:path'
	5	+import { verifyMacosRelease } from './verify-macos-release'
	6	+
	7	+test.skipIf(process.platform !== 'darwin')('distribution entitlements allow a standalone signed CLI to start', () => {
	8	+ const temp = mkdtempSync(join(tmpdir(), 'craft-cli-signing-'))
	9	+ const run = (args: string[]): string => {
	10	+ const result = Bun.spawnSync(args, { cwd: temp, stdout: 'pipe', stderr: 'pipe' })
	11	+ expect({ exitCode: result.exitCode, signal: result.signalCode, stderr: result.stderr.toString() })
	12	+ .toMatchObject({ exitCode: 0 })
	13	+ return result.stdout.toString()
	14	+ }
	15	+ try {
	16	+ writeFileSync(join(temp, 'main.c'), '#include <stdio.h>\nint main(void) { puts("craft version 7.8.9"); return 0; }\n')
	17	+ const binary = join(temp, 'craft')
	18	+ run(['xcrun', 'clang', 'main.c', '-o', binary])
	19	+ run(['codesign', '--force', '--sign', '-', '--options', 'runtime', '--entitlements', resolve(import.meta.dir, 'entitlements-distribution.plist'), binary])
	20	+ run(['codesign', '--verify', '--deep', '--strict', binary])
	21	+ expect(run([binary, '--version']).trim()).toBe('craft version 7.8.9')
	22	+ expect(() => verifyMacosRelease(binary, '7.8.9')).not.toThrow()
	23	+ expect(() => verifyMacosRelease(binary, '7.8.10')).toThrow('Expected craft version 7.8.10')
	24	+ }
	25	+ finally {
	26	+ rmSync(temp, { recursive: true, force: true })
	27	+ }
	28	+}, 30_000)