fix(ci): refresh macOS daemon binaries before signing

[Dimillian]

Summary

• always copy freshly built macOS daemon binaries into the app bundle before re-signing
• avoid leaving stale unsigned nested binaries in the bundle when release artifacts are reused across builds

Why

The latest failed release run died in during with an unsigned nested inside the app bundle. The helper script only replaced daemon binaries when they were missing, which let an existing stale unsigned binary survive in the Intel bundle layout.

Validation

• inspected failed run and traced the failure to CODESIGN_IDENTITY is required. Example:
  CODESIGN_IDENTITY='Developer ID Application: Your Name (TEAMID)' scripts/macos-fix-openssl.sh

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9fc935a480

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid overwriting bundle daemons from generic target/release

daemon_source and daemonctl_source still default to the host build outputs under src-tauri/target/release, so making this copy unconditional now replaces whatever is already embedded in app_path even when the bundle is being reused from a different workspace state or architecture. In that reuse path (for example, re-signing an existing x86_64 bundle after the local checkout last built arm64 binaries), the signed app can silently ship a stale or wrong-arch nested daemon; the previous destination-exists guard was what preserved the already-matched bundle copy.

Useful? React with 👍 / 👎.