[pcvantol]

Scope

Fix released CLI startup identity admission. The app bundles both GUI and CLI under Contents/MacOS. macOS Foundation resolves Bundle.executableURL to the currently running CLI when launched through it, even though sealed CFBundleExecutable names the GUI. The architecture gate previously rejected the CLI as invalidBundleExecutable before any managed work. Read the sealed primary executable declaration and inspect the fixed GUI path instead.

Evidence

• Read-only public 0.3.5 CLI startup reproduced exit 40, currentBundleUnavailable, before helper or product mutation.
• Separate disposable ad-hoc diagnostic copy pinpointed invalidBundleExecutable; after the fix it passed this architecture boundary. That diagnostic copy is not a release or live acceptance claim.
• ./scripts/validate.sh PASS; full native Swift tests PASS; changed production file executable-line coverage 73/75 = 97.333333% (>80.2%).
• Existing signed release 0.3.5 and root-owned staged app remain unmodified. A new canonical release is required before the fixed CLI can be accepted as public/live evidence.

Same LANE_1 assignment pcvantol/forge#141 and PR #75 lineage; frozen Forge 2.7.39/EP 2.3.106 producers, LANE_2 r30 read-only.