build(mac): an unsigned local build launches — dev entitlements without the keychain group, no profile; native build scripts survive a path with a space

[kai-openswarm]

What

Two things stopped bash scripts/build-app.sh — the documented unsigned local build — from producing an app that opens:

1. Unsigned builds were SIGKILLed at exec. electron-builder falls back to an ad-hoc signature but still applied the release entitlements + provisioning profile. keychain-access-groups is a restricted entitlement macOS will not honour on an ad-hoc identity, so the app died at launch with nothing on stderr and no window. Bisected on a local build: the same signature minus that one key launches fine, hardened runtime and all.
   The unsigned path now packs with --dir, re-signs the outer bundle with build/entitlements.mac.dev.plist (production minus that group) and no profile, then builds the dmg/zip from that app with --prepackaged, so what lands in dist/ is what launches. Signed and publish builds are untouched. Passkey sign-in via the shared keychain group is off in a dev build — it could not have worked on an ad-hoc signature anyway.
2. build-mouseclamp.sh / build-haptics.sh invoked $NODE_GYP unquoted; a checkout under a directory with a space split the binary path into two words and the build died before packaging. The command is an array now (the npx fallback is legitimately several words).

Verified

• Local unsigned build on macOS (arm64): the packed app launches with no manual re-signing; the app inside the produced zip carries the dev signature and no embedded profile.
• build-mouseclamp.sh arm64 on a path containing a space builds and stages mouseclamp.node (Mach-O 64-bit bundle arm64).
• plutil -lint on the new plist; it differs from entitlements.mac.plist by exactly keychain-access-groups.