fix(build): strip dangling symlinks so macOS builds aren't "damaged" (#30)

A local macOS tester reported the DMG as "damaged and can't be opened."
Root cause: the bundled tree contained a dangling symlink — rig_builder
ships a build-time link `vst/src/racks/DPF` -> DISTRHO framework that isn't
present at runtime. A broken symlink is harmless on Linux/squashfs (the
AppImage was fine), but on macOS it:
  - breaks codesign — `spctl` reports "a sealed resource is missing or
    invalid", which Gatekeeper surfaces as "damaged"; and
  - breaks `xattr -dr com.apple.quarantine` — it aborts on the dangling
    link, so even the quarantine-removal workaround can't complete.

Strip dangling symlinks from the cloned core+plugins tree after bundling
(safe on every platform — they're broken/unused). Verified on-device:
after removal + ad-hoc re-sign the app verifies clean and launches once
quarantine is cleared.

Also fix build-macos.sh's artifact check, which still globbed the
pre-rebrand `Slopsmith.app` and falsely reported "No artifacts found" for
the now `feedback.app` bundle.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/build-common.sh

@@ -198,6 +198,20 @@ clone_slopsmith() {
 		fi
 	done
 
+	# Strip dangling symlinks from the bundled tree. Some plugins ship
+	# build-time symlinks into sources that aren't present at runtime (e.g.
+	# rig_builder's vst/src/racks/DPF -> DISTRHO framework). A broken symlink
+	# is harmless on Linux/squashfs, but on macOS it BREAKS codesign ("a
+	# sealed resource is missing or invalid" -> the app reads as "damaged")
+	# AND breaks `xattr -dr com.apple.quarantine` (it aborts on the dangling
+	# link, so the quarantine-removal workaround can't complete). Remove them.
+	local _dangling
+	_dangling=$(find "$clone_dir" -type l ! -exec test -e {} \; -print 2>/dev/null | wc -l | tr -d ' ')
+	if [[ "${_dangling:-0}" != "0" ]]; then
+		find "$clone_dir" -type l ! -exec test -e {} \; -delete 2>/dev/null || true
+		echo "Stripped ${_dangling} dangling symlink(s) from the bundled tree (macOS codesign safety)"
+	fi
+
 	export SLOPSMITH_DIR="$clone_dir"
 	echo "Cloned ${cloned} of ${total} plugins"
 	cd - >/dev/null

scripts/build-macos.sh

@@ -153,11 +153,12 @@ bundle_python_impl() {
 # Platform-specific: Return expected artifact patterns
 get_expected_artifacts() {
     # mac.target is "dir": electron-builder writes the unpacked
-    # Slopsmith.app to release/mac-arm64/ (no .dmg/.zip). Velopack's
+    # <productName>.app to release/mac-arm64/ (no .dmg/.zip). Velopack's
     # pack step turns that .app into the actual release assets. Glob
-    # mac*/ so the check also passes for an x64 (mac/) or universal
+    # mac*/*.app so the check matches the productName-derived bundle name
-    # (mac-universal/) local build — verify_artifacts expands this.
+    # (now feedback.app, not the pre-rebrand Slopsmith.app) and also passes
-    printf "%s\n" "$PROJECT_DIR/release/mac*/Slopsmith.app"
+    # for an x64 (mac/) or universal (mac-universal/) local build.
+    printf "%s\n" "$PROJECT_DIR/release/mac*/*.app"
 }
 
 # Platform-specific: Bundle system binaries