macOS: package as Goblin.app bundle, not a bare binary

The macOS CI job lipo'd the universal binary and zipped it raw, so users got a
naked 'goblin' executable instead of a double-clickable app. Assemble the
universal binary into the existing macos/Goblin.app bundle (Info.plist + icon),
ad-hoc codesign it (required for the arm64 slice to run on Apple Silicon after
lipo strips the per-arch signature), and ditto-zip the bundle. Remove the stale
tracked _CodeSignature that would otherwise make the app read as 'damaged'.

.github/workflows/release.yml

@@ -93,12 +93,26 @@ jobs:
           rustup target add aarch64-apple-darwin x86_64-apple-darwin
           cargo build --release --target aarch64-apple-darwin
           cargo build --release --target x86_64-apple-darwin
-      - name: Universal binary + package
+      - name: Universal binary into Goblin.app bundle
         run: |
+          # Combine both arches into one universal Mach-O and drop it into the
+          # app bundle's executable slot (CFBundleExecutable=goblin).
           lipo -create -output goblin \
             target/aarch64-apple-darwin/release/goblin \
             target/x86_64-apple-darwin/release/goblin
-          zip "goblin-$TAG-macos-universal.zip" goblin
+          cp goblin macos/Goblin.app/Contents/MacOS/goblin
+          chmod +x macos/Goblin.app/Contents/MacOS/goblin
+          # Drop the placeholder that kept the empty dir tracked in git.
+          rm -f macos/Goblin.app/Contents/MacOS/.gitignore
+          # Ad-hoc sign (no Apple cert in CI). REQUIRED on Apple Silicon: lipo
+          # strips the per-arch signatures cargo/ld add, and an unsigned arm64
+          # Mach-O is killed by the OS. Ad-hoc gives a valid (if unidentified)
+          # signature; users still right-click → Open past Gatekeeper.
+          codesign --force --sign - macos/Goblin.app/Contents/MacOS/goblin
+          codesign --force --sign - macos/Goblin.app
+          # ditto is the macOS-correct way to zip an .app (preserves the bundle
+          # layout, symlinks and permissions; plain `zip` mangles bundles).
+          ditto -c -k --keepParent macos/Goblin.app "goblin-$TAG-macos-universal.zip"
           shasum -a 256 "goblin-$TAG-macos-universal.zip" > "goblin-$TAG-macos-universal-sha256sum.txt"
       - uses: softprops/action-gh-release@v2
         with:

macos/Goblin.app/Contents/_CodeSignature/CodeResources

@@ -1,128 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>files</key>
-	<dict>
-		<key>Resources/AppIcon.icns</key>
-		<data>
-		F0XBdu5xI+eXrj78HQf2Qr9SKio=
-		</data>
-	</dict>
-	<key>files2</key>
-	<dict>
-		<key>Resources/AppIcon.icns</key>
-		<dict>
-			<key>hash2</key>
-			<data>
-			ZjAn1LaNzSeTeUtKbWKWE7W2ELzhYyrHjKYOXUkQvcI=
-			</data>
-		</dict>
-	</dict>
-	<key>rules</key>
-	<dict>
-		<key>^Resources/</key>
-		<true/>
-		<key>^Resources/.*\.lproj/</key>
-		<dict>
-			<key>optional</key>
-			<true/>
-			<key>weight</key>
-			<real>1000</real>
-		</dict>
-		<key>^Resources/.*\.lproj/locversion.plist$</key>
-		<dict>
-			<key>omit</key>
-			<true/>
-			<key>weight</key>
-			<real>1100</real>
-		</dict>
-		<key>^Resources/Base\.lproj/</key>
-		<dict>
-			<key>weight</key>
-			<real>1010</real>
-		</dict>
-		<key>^version.plist$</key>
-		<true/>
-	</dict>
-	<key>rules2</key>
-	<dict>
-		<key>.*\.dSYM($|/)</key>
-		<dict>
-			<key>weight</key>
-			<real>11</real>
-		</dict>
-		<key>^(.*/)?\.DS_Store$</key>
-		<dict>
-			<key>omit</key>
-			<true/>
-			<key>weight</key>
-			<real>2000</real>
-		</dict>
-		<key>^(Frameworks|SharedFrameworks|PlugIns|Plug-ins|XPCServices|Helpers|MacOS|Library/(Automator|Spotlight|LoginItems))/</key>
-		<dict>
-			<key>nested</key>
-			<true/>
-			<key>weight</key>
-			<real>10</real>
-		</dict>
-		<key>^.*</key>
-		<true/>
-		<key>^Info\.plist$</key>
-		<dict>
-			<key>omit</key>
-			<true/>
-			<key>weight</key>
-			<real>20</real>
-		</dict>
-		<key>^PkgInfo$</key>
-		<dict>
-			<key>omit</key>
-			<true/>
-			<key>weight</key>
-			<real>20</real>
-		</dict>
-		<key>^Resources/</key>
-		<dict>
-			<key>weight</key>
-			<real>20</real>
-		</dict>
-		<key>^Resources/.*\.lproj/</key>
-		<dict>
-			<key>optional</key>
-			<true/>
-			<key>weight</key>
-			<real>1000</real>
-		</dict>
-		<key>^Resources/.*\.lproj/locversion.plist$</key>
-		<dict>
-			<key>omit</key>
-			<true/>
-			<key>weight</key>
-			<real>1100</real>
-		</dict>
-		<key>^Resources/Base\.lproj/</key>
-		<dict>
-			<key>weight</key>
-			<real>1010</real>
-		</dict>
-		<key>^[^/]+$</key>
-		<dict>
-			<key>nested</key>
-			<true/>
-			<key>weight</key>
-			<real>10</real>
-		</dict>
-		<key>^embedded\.provisionprofile$</key>
-		<dict>
-			<key>weight</key>
-			<real>20</real>
-		</dict>
-		<key>^version\.plist$</key>
-		<dict>
-			<key>weight</key>
-			<real>20</real>
-		</dict>
-	</dict>
-</dict>
-</plist>