[gotzastory]

Summary

Adds first-class Linux and macOS packaging and runtime paths while keeping the Windows NSIS installer and signing story unchanged. Electron stays on 43.x (no upgrade to 44).

Packaging

• Linux: AppImage + deb; desktopName / app id com.openpood.app (matches generated .desktop for Wayland portals)
• macOS: dmg + zip for x64 and arm64; ad-hoc identity - via package.json mac.identity (not CSC_IDENTITY — electron-builder does not need that env when identity is set in config); entitlements file kept for future use
• Note: hardenedRuntime is off, so the entitlements plist has little practical effect today; kept so flipping hardened runtime later is a smaller change
• Windows: NSIS unchanged (no signing changes)

Release workflow

• Matrix: windows-latest, ubuntu-latest, macos-latest
• Produces latest.yml, latest-linux.yml, and latest-mac.yml
• mac job loops every built .app under release/ (x64 + arm64), requires Signature=adhoc on each, and fails if no arm64 .app is found (also fails if none found)
• verify-update-artifacts.cjs checks app-update.yml points at gotzastory/OpenPood on Windows (win-unpacked), Linux (linux-unpacked), and inside each mac .app (Contents/Resources/app-update.yml)
• Triggers only on tag push v* or workflow_dispatch
• workflow_dispatch on a non-tag ref: build + verify + upload workflow artifacts only. Publish job is gated on github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v'). Build always uses npm run dist (--publish never). Safe for Got to dispatch on this branch.

Runtime

• macOS paste via AppleScript Cmd+V (Accessibility); Linux via xdotool (X11) or wtype/ydotool (Wayland)
• Hotkey registration failures on Wayland notify the user with a clipboard fallback message
• If paste injection fails / tools missing: notify + leave transcript on clipboard (never silent loss) — covered by unit tests
• macOS: systemPreferences mic + Accessibility prompts
• Updater: in-app only for Windows + AppImage; unsigned macOS and .deb open the GitHub Releases download page (tests included)

Docs

• README: macOS System Settings → Privacy & Security → Open Anyway as primary path (macOS 15+); xattr -dr com.apple.quarantine alternative; Linux AppImage/deb notes; .deb has no in-app auto-update

Known limitation (Got’s call)

GNOME 50 global hotkeys need Electron 44. This PR does not upgrade Electron. Staying on 43.x means GNOME 50 portal hotkeys may remain limited until Got decides to bump Electron.

What Got must test on real machines

Please run these before merging (map to QA checklist where noted):

Machine	Checks
macOS Intel	Install via DMG → Open Anyway in Privacy & Security; mic + Accessibility prompts; dictate → paste (Cmd+V path); update button opens Releases (MA1a)
macOS Apple Silicon	Same as Intel; confirm ad-hoc signed .app launches; arm64 artifact
Linux X11	AppImage + deb install; global hotkey; paste via xdotool; AppImage in-app update path (LD1a)
Linux Wayland / GNOME	Hotkey behavior; if registration/paste fails → notification + text remains on clipboard for Ctrl+V (LD1b); note Electron 44 / GNOME 50 limitation
KDE (X11 and/or Wayland if available)	Hotkey + paste; clipboard fallback if injection unavailable

Also smoke: Escape cancel, tray open Settings/History, quit, and Windows NSIS regression (unchanged path).

Test plan (CI / local)

• npm test
• npm run typecheck
• npm run build
• Got: workflow_dispatch Release on this branch (artifact-only; no tag/release)
• Real-machine QA above (Got)

Out of scope

• No Electron 44 upgrade
• No Windows installer signing changes
• No tag / GitHub Release from this PR
• Do not merge until Got’s machine QA is done