macOS floor check: unextractable minos warns and PASSES, silently disabling the upstream-floor tripwire

[robertcsakany]

Summary

The macOS floor check treats an unextractable minos as a ::warning:: and lets the
job pass:

• spec: openspec/specs/electron-build-pipeline/spec.md — "the job SHALL emit a
  ::warning:: (not fail) if minos cannot be extracted at all (e.g., binary uses an
  unrecognized load-command format), so the verification is robust to future Mach-O format
  changes"
• code: packages/electron/scripts/verify-macos-floor.mjs maps not-extractable and
  non-numeric to ::warning:: + exit 0.

Why this is worth revisiting

The otool leg is the only guard that detects a future Electron raising its own
macOS floor. It is not a check on our build flags — the binary it inspects is the renamed
upstream Electron prebuilt, whose LC_BUILD_VERSION is baked by the Electron release and
copied verbatim (see design.md Decision 2 of upgrade-electron-runtime).

Crucially, the sibling check cannot cover for it: the Info.plist assertion reads our
declared LSMinimumSystemVersion, which would still be 12.0 in exactly that scenario. So
if otool -l output ever changes shape, extractMinosValues returns [], the leg passes,
and the tripwire is silently dead — the same fail-open shape that
upgrade-electron-runtime went to some length to eliminate on the update-metadata side.

Provenance

Flagged independently by two reviewers on #532:

• the local @review pass (round 1, issue(non-blocking) N1), which noted it could not
  find a current otool -l shape that returns [] on a valid binary — the risk is
  forward-looking, not present-day;
• CodeRabbit (Stability & Availability, Major): "Warning and continuing bypasses the
  upstream Electron floor check."

Deliberately not changed in #532: it is pre-existing spec language, and flipping a
::warning:: to a hard failure changes the shipped CI contract and would have required
editing an already-archived OpenSpec delta.

Options

1. Canary (suggested). Keep the tolerant path, but assert at build time that
   extractMinosValues returns ≥1 value for the known installed prebuilt
   (node_modules/electron/dist/Electron.app/Contents/MacOS/Electron). A format change then
   fails loudly instead of silently disabling the tripwire, and genuinely novel formats on
   other binaries still degrade gracefully.
2. Hard-fail on not-extractable for the main app binary specifically (we know it is a
   Mach-O Electron prebuilt and therefore has LC_BUILD_VERSION), keeping the warning only
   for the legacy LC_VERSION_MIN_MACOSX fallback path.
3. Accept as-is and document the residual risk in the spec.

Any of these needs the spec sentence updated to match.

Found by: change upgrade-electron-runtime (#532).