[4.0.0-beta desktop] Builds are unsigned, Apple-Silicon-only, and not a Windows installer #252

PROBLEM

Even after CBL is bundled, the current artifacts will still look "broken" to users:

1. Not notarized / not signed. Mac spec and CI set codesign_identity=None. Gatekeeper blocks first launch ("app is damaged" / "cannot be opened"). Release notes mention xattr -dr com.apple.quarantine, but that is easy to miss.
2. arm64-only DMG. runs-on: macos-latest is Apple Silicon. Spec comments / docs say universal (target_arch='universal2'), but GHA Python is a single arch. Intel Macs cannot run the build.
3. Windows is a zip of a onefile exe, not QueryAnalyzer-4.0.0-Beta-Setup.exe. README promises a Setup.exe. SmartScreen flags the unsigned onefile binary. build_msi.ps1 is never called.

Download counts on v4.0.0-beta already show people hitting these files (macOS DMG 4, Windows zip 2 as of review).

Suggested RCA

Signing was deferred ("unsigned beta") but the product copy still reads like a shippable installer. universal2 was copied from the design doc without a universal CPython on the runner. Windows CI used the fastest PyInstaller flags (--onefile) instead of the onedir + MSI path in 08_PACKAGING_WINDOWS.md.

Suggested FIX

Short term (beta honesty):

• Keep unsigned, but name the assets …-UNSIGNED-arm64.dmg / …-UNSIGNED-x64.zip.
• Put the xattr command in the DMG README (a README.txt next to the .app), not only on the GitHub Release body.
• Document "Apple Silicon only" until a second macos-13 Intel job exists.

Medium term:

# matrix, not universal2 on one runner
strategy:
  matrix:
    include:
      - os: macos-14
        arch: arm64
      - os: macos-13
        arch: x86_64

Do not set target_arch='universal2' unless lipo -archs $(python -c "import sys; print(sys.executable)") shows both slices.

Windows: switch to onedir (required for cblite.dll next to the exe) and, if you still want Setup.exe, run WiX after the spec is valid (sibling issue on build_msi.ps1).

Unit tests

# tests/python/test_packaging_identity.py
from pathlib import Path

def test_mac_spec_does_not_claim_universal2():
    src = Path("app/build_mac.spec").read_text()
    assert "universal2" not in src

def test_readme_does_not_promise_setup_exe_until_msi_exists():
    readme = Path("README.md").read_text()
    msi_script = Path("app/scripts/build_msi.ps1").read_text()
    if "Setup.exe" in readme:
        # either the workflow must produce it, or the README is lying
        wf = Path(".github/workflows/release-4.0.0-beta.yml").read_text()
        assert "build_msi.ps1" in wf or "Setup.exe" not in readme

def test_release_workflow_records_arch_in_asset_name():
    wf = Path(".github/workflows/release-4.0.0-beta.yml").read_text()
    assert "arm64" in wf or "x86_64" in wf or "UNSIGNED" in wf

Context: found on branch release-4.0.0-beta while reviewing standalone macOS .app / Windows .exe packaging. Issues in this batch share the title prefix [4.0.0-beta desktop].