release: Validate native macOS beta packages and wire notarization

[zackees]

Refs #630, #631 and #635.

Changes

• Set up the existing macOS signing action before builds and pass its actual credential availability to the existing build/package actions. Notarization is enabled only when signing and notarization credentials are both present; existing signing/notarytool/stapler failures remain fatal.
• Document Open Anyway and targeted quarantine removal for current unnotarized downloads. No release signing credentials are currently configured, so this PR does not claim a signed/notarized release or Apple acceptance.
• Keep CFBundleShortVersionString and CFBundleVersion numeric (release semver and build date), with the complete Rust beta version in OBSStudioRustVersion. Tests execute the actual CMake helper and preserve upstream fallback behavior.
• Install the actual DMG on native Apple Silicon and Intel runners, verify its architecture, signature structure and all version fields, exercise the documented quarantine removal on that copied app, and launch the saved screen/camera/microphone profile via the shared packaged-startup helper.
• Validate live websocket registration and saved profile/scene/input state, PNG and JPEG screenshots, and clean shutdown. Publication requires both macOS native smoke targets.

Hosted runners do not supply physical camera/microphone devices. The smoke proves packaged plugin registration, saved state, rendering/codecs, and startup/shutdown; physical camera/microphone frames and TCC grants are not claimed.

RED → GREEN

• 24e101761: regression tests require missing signing/notarization credential wiring.

• 54b0f18b0: tests require Apple-compatible numeric bundle versions, full beta identity and actual CMake-helper behavior.

• 269c629f6: tests require both native saved-profile DMG smoke targets and publication dependencies.

• Production run 38492393948 failed the DMG volume reader on both architectures after real compilation/packaging. The parent release: Build and validate the Windows ARM64 beta package #664 now reads a regular plist file and retains the strict volume-name check.

• Production run 38498613510 genuinely failed both native macOS smoke jobs: the old lipo invocation parsed the trailing executable as an architecture argument. The corrected command puts the actual Mach-O input before -verify_arch, retaining strict verification.

Validation

157 CI Python tests pass. Focused macOS review is clean, including the lipo correction. Fresh ./lint and ./unittest pass on the corrected tree: OFF/ON each pass 193 C tests and export 1766 identical symbols. The branch now inherits #672's actual-input-expression and duplicate-key corrections; rebasing onto its stamped commit preserved the exact macOS tree. Fresh attestation passed all four lanes in 438 seconds and stamped exact pushed head 5750a6ce8b9565935f70762c1b2f21fb4a633c24 (tree c927334ac15e5201ca3ad722816bbb3310e2a823).

The immutable production run 38498613510 completed failure. It built and collected both macOS packages, including correct numeric Apple fields 0.1.0 / 2026.10.14 and full Rust beta identity, then failed at the lipo invocation before frontend startup. Run 38500786530 was explicitly cancelled because it retained the known command defect. Neither run proves native frontend startup. Fresh exact-head package verification is required before merge; this remains draft.

Signing/notarization requires the project's credentials, which are not currently configured; notarization is not claimed.

Native readiness correction

Run 38507392203 at 5750a6ce8b9565935f70762c1b2f21fb4a633c24 completed failure: both actual native DMGs passed metadata/architecture/signature/quarantine checks and launched, then returned explicit protocol NotReady (207) after websocket authentication. Identification precedes frontend FINISHED_LOADING.

Local RED fb46c84c0 / GREEN f51e9ffd6 add a bounded readiness wait for a real GetInputKindList success. Only 207 is retryable, process exit and other failures stay fatal, and all saved-profile/capture-plugin/scene/item/PNG/JPEG assertions remain intact. Nine focused tests and review pass. Fresh lint/unit pass OFF/ON (193 tests each, 1766 identical exports). Fresh attestation passed all four lanes in 432 seconds and stamped exact pushed head c2da0520b911ef688ebdb8a932caecf11491ee7c (tree 9dc8dbb9a0d28277e898623b231bde8736da9c03). All 160 CI Python tests pass. Fresh native verification 38511518451 is queued/running; native GREEN remains pending before merge.

Final exact-head native evidence

Production verify-only 38511518451 completed success at exact pushed c2da0520b911ef688ebdb8a932caecf11491ee7c: all five desktop packages, full release gate, AppImage distro tests, native Windows ARM64 startup/missing-plugin mutation, and both actual native macOS DMG smoke jobs pass. Native Apple Silicon job 115687414445 and Intel job 115687414460 validate architecture, signature structure, numeric/full identity and targeted quarantine recovery, followed by live capture-plugin/profile/scene/item assertions, PNG/JPEG screenshots and normal exit status zero. This is runtime GREEN for the prior lipo and NotReady failures. All routine PR checks are terminal with no failures, and base is master.

Current repository secret metadata is empty; signed/notarized artifacts and Apple acceptance are not claimed. Hosted physical camera/microphone capture and TCC grants remain unproven. The Apple Silicon app log reports one tracked allocation at its shutdown diagnostic checkpoint (Intel reports zero); the smoke verifies normal exit, not leak-free execution. That observation is not attributed to this metadata/signing change or represented as resolved.

[zackees]

Replaced head 31f4c56 with stamped 3d70657 after rebasing the #664 stack onto master 0a50b7c (#666/#654). Both strict volume parsing and numeric/full beta identity checks are preserved.

Fresh lint/unit, 151 CI Python tests, review, and all four attestation lanes pass (418 seconds, tree 33a40af83248). OFF/ON CTest report zero failures out of 192, with 1766 identical exports. Actual Apple Silicon packaging in the older immutable run 38498613510 now shows numeric 0.1.0/2026.10.14 and full Rust beta CLI identity; native saved-profile startup still needs to pass. The old run continues; it is not being restarted or represented as evidence for the rebased head.

Dispatching fresh verify_only package verification for this newly pushed stamped head. Draft status remains until actual native startup evidence is complete; notarization is not claimed without credentials.

[zackees]

Actual native Intel RED: job 115647822102 in run 38498613510 stopped before application launch. lipo -verify_arch "$TARGET" "$App/Contents/MacOS/OBS" treats the trailing executable path as another architecture (the native usage lists input-file before command, and -verify_arch has variadic operands). The app's startup behavior has not been validated by this job.

Local GREEN 28e18c418 changes only operand order to lipo "$App/Contents/MacOS/OBS" -verify_arch "$TARGET", preserving the required architecture check. All 18 focused tests pass; fresh mandatory gates are running before push. The pending run 38500786530 contained the known-broken command, so cancellation was requested to avoid building a candidate already known to fail this test. The older immutable run continues; it is not being restarted. A new candidate run will follow the repaired stamped head. Draft status remains.

[zackees]

Replaced head 3d70657c66ddb4f6e1a878e43170b9f59f8d5de6 with exact stamped 5750a6ce8b9565935f70762c1b2f21fb4a633c24. The branch is now stacked on #672, preserving its expression and duplicate-input corrections. Fresh lint/unit and all four attestation lanes pass (438 seconds), with 193 C tests passing OFF/ON and 1766 identical exports.

This head fixes the actual native lipo failure from run 38498613510 without weakening the architecture check. Fresh immutable native package verification will cover both DMGs, the saved capture profile, screenshots and clean shutdown. The old failed run and the explicitly cancelled known-bad run 38500786530 are retained as evidence, not counted as passes. This remains draft pending actual native startup. No signing/notarization credentials are configured, and successful notarization is not claimed.

[zackees]

Actual native Apple Silicon job 115674349847 failed at head 5750a6ce8b9565935f70762c1b2f21fb4a633c24. The DMG passed architecture, signature structure, numeric/full version fields and quarantine-removal checks, then launched the real frontend. Its authenticated websocket request returned explicit NotReady (207) before OBS_FRONTEND_EVENT_FINISHED_LOADING. This is retained as native RED; the earlier lipo correction reached the frontend.

Local RED fb46c84c0 and GREEN f51e9ffd6 add bounded protocol readiness: only 207 from GetInputKindList is retried, within the existing startup deadline, until a real successful response. Process exit and other protocol failures remain fatal; all capture-plugin/profile/scene/item/PNG/JPEG assertions remain unchanged. No new sleep. Nine focused tests pass, including readiness sequence, fatal non-readiness errors and deadline exhaustion. Fresh lint/unit gates and review are running before push. Native GREEN remains unproven; this PR remains draft. The still-live Intel job is retained rather than restarted due to observation timeouts.

[zackees]

Pushed exact stamped c2da0520b911ef688ebdb8a932caecf11491ee7c with the readiness correction. Fresh lint/unit and all four attestation lanes pass (432 seconds), OFF/ON each pass 193 C tests with 1766 identical exports, all 160 CI Python tests pass, and review is clean.

Both native jobs in run 38507392203 are now terminal failure at the same explicit NotReady 207 response; their real failures are retained. New exact-head verify-only run 38511518451 tests the correction against actual native DMGs. No assertions or publication gates were removed. This remains draft pending native GREEN.