fix: install signed bundled OMP runtime

[wolfiesch]

What changed

• keep verifying the original public OMP size and SHA-256 before packaging
• when Apple signing changes the bundled executable bytes, verify the exact pinned Developer ID certificate, Team ID, hardened runtime, and timestamp
• copy the actual signed bytes atomically and verify the installed copy
• stream runtime hashing instead of loading the 120 MB executable into memory
• prepare the v0.1.25 repair release contract and notes

Why

The public v0.1.24 Mac app is correctly signed and notarized, but the first-launch installer compares its signed OMP executable to the pre-sign download hash. Apple code signing changes the file bytes, so v0.1.24 rejects its own bundled backend.

Verified

• real installer code successfully installed the signed OMP binary from the public v0.1.24 DMG
• exact Developer ID certificate validation passed
• release consistency passed for v0.1.25
• clean-worktree provenance check passed
• lint and all workspace type checks passed
• desktop: 116 tests passed
• packaging: 45 tests passed

[Copilot]

Pull request overview

This PR updates the macOS bundled OMP runtime installation flow so signed/notarized builds can install and validate their bundled backend even when Apple code signing changes the executable bytes, while also rolling the repo forward to the v0.1.25 release contract.

Changes:

• Add support for accepting a bundled OMP executable that either matches the original pinned (pre-sign) hash/size or is signed by the pinned Developer ID identity, and install the exact signed bytes atomically.
• Stream SHA-256 hashing of the runtime instead of reading the full executable into memory.
• Bump the release/version contract across docs, tests, and package metadata from v0.1.24 to v0.1.25.

Reviewed changes

Copilot reviewed 27 out of 27 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
SECURITY.md	Updates macOS signing/notarization scope note to v0.1.25.
scripts/check-release-consistency.test.mjs	Updates consistency tests to expect v0.1.25 contract strings.
README.md	Updates download links, release notes section, and v0.1.25 messaging.
packages/ui/package.json	Bumps package version to 0.1.25.
packages/service-manager/package.json	Bumps package version to 0.1.25.
packages/remote/package.json	Bumps package version to 0.1.25.
packages/protocol/test/fixtures/platform-boundaries.ts	Updates fixture “latestVersion” values to 0.1.25.
packages/protocol/package.json	Bumps package version to 0.1.25.
packages/fixture-server/package.json	Bumps package version to 0.1.25.
packages/client/src/omp-client-frames.ts	Updates default client hello version to 0.1.25.
packages/client/package.json	Bumps package version to 0.1.25.
package.json	Bumps workspace root version to 0.1.25.
e2e/site-mobile-docs.spec.ts	Updates expected Android APK download URL to v0.1.25.
docs/CURRENT_RELEASE_NOTES.md	Updates current release notes to describe the v0.1.25 macOS backend install fix.
compat/omp-app-matrix.json	Updates protocol/package version mapping to 0.1.25.
apps/web/src/platform/browser-shell-port.ts	Updates web client version to 0.1.25.
apps/web/package.json	Bumps app version to 0.1.25.
apps/site/test/release.test.ts	Updates release contract tests for v0.1.25 asset names/URLs.
apps/site/src/release.ts	Updates release constants and asset filenames to v0.1.25.
apps/site/package.json	Bumps app version to 0.1.25.
apps/mobile/package.json	Bumps app version to 0.1.25.
apps/mobile/capacitor.config.json	Updates appended mobile user agent version to 0.1.25.
apps/desktop/test/bundled-runtime.test.ts	Adds coverage for accepting/verifying a signed bundled runtime path.
apps/desktop/src/target-manager.ts	Updates desktop client version to 0.1.25.
apps/desktop/src/bundled-runtime.ts	Implements signed-runtime verification path + streamed hashing + atomic copy/verification.
apps/desktop/package.json	Bumps app version to 0.1.25.
.github/ISSUE_TEMPLATE/bug_report.yml	Updates bug report template version placeholder to 0.1.25.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.