fix(desktop): accept Intel Mach-O architecture in package verification

[Astro-Han]

Summary

Intel macOS Nightly packaging and Apple notarization succeed, but verification fails with Maka executable must contain only x64, found: x86_64 (failed run). The verifier compares Node's target name directly with lipo's Mach-O architecture name, preventing the entire Desktop release from publishing.

Map x64 to x86_64 at the existing architecture assertion. Both Nightly and formal releases use this verifier; wrong architectures and universal binaries remain rejected. No artifact naming, update configuration, or migration changes are needed. The existing assertion is extended without adding a second architecture authority; one regression test covers the observed Intel failure through the packaged-app verifier.

Verification

• The Intel regression failed with the exact Nightly error before the fix and passed afterward.
• node --test scripts/verify-packaged-app.test.mjs — 19 passed, including the single Intel regression.
• node --test scripts/desktop-nightly-stage.test.mjs — 2 passed during the initial validation; the staging code is unchanged.
• npm run format and npm run lint — passed.
• Built the core, storage, MCP, and runtime workspaces required to load the verifier. No TypeScript changed.
• The regression test uses real ASAR and update configuration fixtures, substituting macOS commands and app launches. It does not establish that a new signed Intel build or release publication succeeds.

Rollout

After review and merge, dispatch a fresh npm Nightly; Desktop Nightly rejects in-place workflow reruns. Confirm all five Desktop targets pass, including Intel signing verification and PTY/filesystem-worker/renderer smoke checks, then confirm the GitHub prerelease and downloadable artifacts are published. This PR has not triggered another Nightly.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex diagnosed the failed run, implemented the mapping, and added and ran the Intel regression test.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally (typecheck is not applicable to the MJS-only changes)

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[jackwener]

I reviewed this at bf70e51a5cc81639cefe5a8f98551ccf5c72fb03. No P0, P1, P2, or P3. No UI, so nothing to grade for accessibility.

I independently confirmed the Nightly failure: job desktop (macos, x64, macos-15-intel) on run 33671124683 notarized Maka-0.2.0-dev.14.20260902-mac-x64.dmg, then npm run verify:macos -- "x64" died with Maka executable must contain only x64, found: x86_64. The other four Desktop targets on that run succeeded.

The cut is right: lipo -archs speaks Mach-O (x86_64), the release target and Node speak x64, and the existing single-architecture assertion was comparing those strings directly. Mapping only x64 → x86_64 at that one check leaves arm64 as identity, still rejects a second slice, and does not add another architecture authority. The workflow already passes x64 into verify:macos; artifact names and feeds are untouched.

The regression drives verifyPackagedMacApp with a real ASAR and update-config fixture and substitutes lipo to x86_64. Hosted test is green on this head. Draft. I am not merging it. A fresh npm Nightly after merge is still required to prove a signed Intel publication.

简体中文

我审的是 bf70e51a5cc81639cefe5a8f98551ccf5c72fb03。没有 P0/P1/P2/P3。没有界面，无可及性项。

独立核对了 Nightly：Intel 任务公证成功后，verify:macos -- x64 报 must contain only x64, found: x86_64。其它四个 Desktop 目标过了。

lipo 说 x86_64，发布目标说 x64，只在原有单架构断言上做这一处映射，不另立权威。arm64 不变，多 slice 仍拒。回归测试走真实 ASAR 夹具。hosted test 绿。草稿。我不合入。合入后仍需新的 npm Nightly 才能证明签名后的 Intel 发布。

---

Automated review notice: This comment was posted by an automated review agent operated by WAWQAQ. It is not an independent human review and does not replace one.