fix(bundle): ship spaceshd inside the .app (packaged GUI was offline)

tauri build bundled only the GUI binary, so the packaged app had no daemon:
find_daemon() looks for a sibling `spaceshd` next to the GUI
(Contents/MacOS/spaceshd) and ensure_daemon failed to spawn it → "offline".
(Dev worked only because find_daemon falls back to the repo-root target path.)

- tauri.bundle.conf.json: a build-only overlay adding bundle.externalBin
  ["bin/spaceshd"], kept out of tauri.conf.json so `tauri dev` doesn't require
  a sidecar file.
- Makefile: `make dmg` now builds spaceshd for both arches, lipo's a universal
  sidecar into src-tauri/bin/spaceshd-universal-apple-darwin, and passes
  --config so it lands in Contents/MacOS/spaceshd. `make dmg-native` does the
  host-arch equivalent.
- .gitignore: ignore the generated app/src-tauri/bin/.

After install, the unsigned helper runs once quarantine is cleared recursively:
xattr -dr com.apple.quarantine /Applications/spacesh.app

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitignore

@@ -3,3 +3,6 @@
 node_modules/
 app/dist/
 .DS_Store
+
+# Generated daemon sidecar for DMG bundling (make dmg)
+app/src-tauri/bin/

Makefile

@@ -5,6 +5,9 @@ APP_DIR         := app
 TAURI_TARGET    := universal-apple-darwin
 DMG_DIR         := $(APP_DIR)/src-tauri/target/$(TAURI_TARGET)/release/bundle/dmg
 NATIVE_DMG_DIR  := $(APP_DIR)/src-tauri/target/release/bundle/dmg
+NATIVE_TRIPLE   := $(shell rustc -vV 2>/dev/null | awk '/^host:/{print $$2}')
+SIDECAR_DIR     := $(APP_DIR)/src-tauri/bin
+BUNDLE_CONFIG   := src-tauri/tauri.bundle.conf.json
 APP_VERSION     := $(shell node -p "require('./$(APP_DIR)/src-tauri/tauri.conf.json').version" 2>/dev/null || echo 0.0.0)
 
 LANDING_IMAGE   := spacesh-landing
@@ -32,12 +35,23 @@ targets: ## add rust targets for the universal build
 
 .PHONY: dmg
 dmg: targets ## build the universal (Intel + Apple Silicon) .dmg — UNSIGNED
-	cd $(APP_DIR) && npm run tauri build -- --target $(TAURI_TARGET)
+	# Build the daemon for both arches and lipo into a universal sidecar so it
+	# ships inside spacesh.app/Contents/MacOS/spaceshd (else the GUI is offline).
+	cargo build --release -p spaceshd --target aarch64-apple-darwin
+	cargo build --release -p spaceshd --target x86_64-apple-darwin
+	mkdir -p $(SIDECAR_DIR)
+	lipo -create -output $(SIDECAR_DIR)/spaceshd-universal-apple-darwin \
+		target/aarch64-apple-darwin/release/spaceshd \
+		target/x86_64-apple-darwin/release/spaceshd
+	cd $(APP_DIR) && npm run tauri build -- --target $(TAURI_TARGET) --config $(BUNDLE_CONFIG)
 	@echo "→ $(DMG_DIR)" && ls -lh $(DMG_DIR)/*.dmg
 
 .PHONY: dmg-native
 dmg-native: ## build a .dmg for the current arch only (faster)
-	cd $(APP_DIR) && npm run tauri build
+	cargo build --release -p spaceshd
+	mkdir -p $(SIDECAR_DIR)
+	cp target/release/spaceshd $(SIDECAR_DIR)/spaceshd-$(NATIVE_TRIPLE)
+	cd $(APP_DIR) && npm run tauri build -- --config $(BUNDLE_CONFIG)
 	@ls -lh $(NATIVE_DMG_DIR)/*.dmg
 
 .PHONY: dev

app/src-tauri/tauri.bundle.conf.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "bundle": {
+    "externalBin": ["bin/spaceshd"]
+  }
+}