Preserve valid upstream Mach-O signatures during no-op runtime normalization

Parent: #227. Related delivery failure: the Craft 0.0.423 normal Pantry installation.

The normal published Darwin artifact changes a valid upstream Developer ID signed executable even though none of its loader paths need changing. normalizeMachoRuntime() in packages/ts-pantry/scripts/native-runtime.ts unconditionally invokes codesign --force --sign - after its loader inspection.

Actual evidence from publisher run 41428888448, Darwin job 125222315803:

• Original public Craft 0.0.423 executable: 14,893,984 bytes, SHA256 c96fe815e228088ce6fd04999b2db93f517d5a584a42f9e9c01bb6a0709948de.
• Normal registry tar SHA256 33c8331bb8c72792839b70020760d8f818d84eace7a5f6f51a2a14de90b86c5f contains exactly the installed executable: 14,979,728 bytes, SHA256 ad38c72624e939e633ed5eb7a134685ded6819bad524f9665336e0ba637b4b7c.
• Every pre-signature byte is identical except the three signature-size fields in __LINKEDIT and LC_CODE_SIGNATURE. The entire 85,744-byte growth is signature growth.
• Both signatures verify cryptographically, but the original Developer ID team and hardened-runtime flag are replaced by ad-hoc signing. The original com.apple.security.cs.allow-jit entitlement is lost. The installed CLI has not been executed.

Acceptance:

• Through the maintained fixUp() seam, preserve an unchanged valid signed image byte-for-byte, including signature, identifier, flags and entitlements. Repeated normalization must be idempotent.
• Keep required signing for actual loader changes and unsigned images. Include a dependency-only install-name rewrite performed by bundleRuntimeLibraries() before normalization, while RPATHs and install IDs are already canonical.
• Use real macOS compiler/codesign fixtures and signature verification, not mocked tool output or a Craft-specific skip flag.
• Publish corrected artifacts under a new immutable Pantry recipe revision and verify normal installation against the original upstream bytes before claiming delivery.

The correction belongs to the generic native-runtime normalizer. Do not skip loader checks, weaken publication validation or replace the native executable manually.

Related Linux delivery work: #266.

Closing the generic no-op Mach-O signing repair. 241fd7be preserves an unchanged valid signature; 9028f58c publishes the immutable423.1 recipe revision. Existing bad423 artifacts were not overwritten. Real compiler/codesign fixtures prove repeated fixUp byte/mode/signature idempotence while unsigned images, actual loader edits and earlier dependency-only rewrites still get required signing. No mocked tool output or Craft-specific skip was used.

Normal423.1 Darwin publisher125242205853 succeeded. Its original tar SHA256e02425cc267a9ac5eded9bb84573950312fb9ff880ed6ef150ba5ad892818cb5 and all4 original signed binaries were independently verified. New424 normal Darwin publication also preserves all4 upstream424 images byte-for-byte, separately qualified in /tmp/pantry-craft-0.0.424-registry-verification/publication-proof.json SHA25609d9b3ccb72242078506a12dfbb6810fe318e5047d60cea181c09d08720d3074; that publisher's overall Linux failure remains #266. The previously blocking auxiliary activation #268 is now verified through the released installer.

Required exact-source159 Main CI41447621606, Releaser41447621136 and Deploy41447621420 all succeeded on eafe53d87d16df291afcce45d8ae6ad7a775d8d9. All14 required source jobs, seven native release builds, actual npm publication/readback and deployment are retained. The separate standalone Zig run was cancelled by normal concurrency after unrelated newer main852a0612; it is explicitly not counted passing. No gate, test or deadline was changed or bypassed.

Independently qualified all7 original public native ZIPs/manifest and actual npm159 payload: tag/source bindings, API sizes/digests, safe members/CRCs, accepted SHA1/SHA512, full1,865-file npm inventory and SLSA payload source/subject/run association. No independent cryptographic Sigstore-chain claim. Qualification /tmp/pantry-159-qualification/qualification-proof.json, SHA2560682e5766fe3e7b1d737f73d018e75ea6e3a1d02ae089d631683c8f1cf247e85.

The normal156self-upgrade selected159. Its actual installed9,040,328-byte DarwinARM64 executable hashes to 597a927c30dc663721e40c9a4f7438aed578520210cb6e28521ecadc5db4439b, exactly the verified public159 member, and reports pantry 0.11.159 (eafe53d87). Then the unchanged ordinary pantry install --user craft@0.0.423.1 completed successfully from the existing cache. All three previously stale auxiliaries now select423.1; the primary remains correctly selected. All4 actual selected Mach-Os equal their original upstream423 signed bytes, pass strict OS signature verification with DeveloperID3JJRNQW6B7/hardened runtime/JIT entitlement, and each normal bare command returns423with exit0.

Normal acceptance /tmp/pantry-159-normal-activation/craft-423.1-normal-installer-acceptance.json, SHA2569cf56f3c0c83083055f9d17fbfba6e92f7001e4524bee444459bc14656436664. No manual shim edits, deleted cache, force flag, PATH overlay, substitute runtime or profile fallback was used. This is signed program delivery/activation acceptance, not native game, replay/persistent-frame, physicalGPU or Gold fidelity acceptance. Linux runtime-provider #266 and downstream framework/application adoption remain separate.