emrg: macOS 代码签名 CI — 证书导入 + codesign + pkg productsign（rant 10:06:55 P1/P2）

.github/workflows/build-release.yml

@@ -49,6 +49,24 @@ jobs:
         with:
           node-version: "22"
 
+      # ── macOS 代码签名（rant 2026-08-06T10:06:55 P1/P2；Secret 未配则跳过降级）──
+      - name: Import signing certificate (macOS only)
+        if: runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_BASE64 != ''
+        shell: bash
+        env:
+          MACOS_SIGNING_P12_BASE64: ${{ secrets.MACOS_SIGNING_P12_BASE64 }}
+          MACOS_SIGNING_P12_PASSWORD: ${{ secrets.MACOS_SIGNING_P12_PASSWORD }}
+        run: |
+          echo "$MACOS_SIGNING_P12_BASE64" | base64 --decode > /tmp/signing.p12
+          security create-keychain -p 'ci-temp' /tmp/ci.keychain
+          security set-keychain-settings -lut 21600 /tmp/ci.keychain
+          security unlock-keychain -p 'ci-temp' /tmp/ci.keychain
+          security import /tmp/signing.p12 -k /tmp/ci.keychain -P "$MACOS_SIGNING_P12_PASSWORD" \
+            -T /usr/bin/codesign -T /usr/bin/productsign
+          security set-key-partition-list -S apple-tool:,apple: -k 'ci-temp' /tmp/ci.keychain
+          security list-keychains -d user -s /tmp/ci.keychain $(security list-keychains -d user | tr -d '"')
+          security find-identity -v -p codesigning /tmp/ci.keychain
+
       # ── 回归门禁 ─────────────────────────────────────────────
       - name: Python tests (regression gate)
         run: |
@@ -80,6 +98,11 @@ jobs:
       - name: Build GUI (electron-builder)
         working-directory: emrg/gui
         shell: bash
+        env:
+          # macOS 签名：CSC_LINK+CSC_KEY_PASSWORD 激活 electron-builder 自动 codesign
+          # （含 hardened runtime；Secret 未配时为空 → 不签名，保持现状降级）
+          CSC_LINK: ${{ runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_BASE64 != '' && 'file:///tmp/signing.p12' || '' }}
+          CSC_KEY_PASSWORD: ${{ runner.os == 'macOS' && secrets.MACOS_SIGNING_P12_PASSWORD || '' }}
         run: |
           npm ci
           npm run dist
@@ -94,6 +117,19 @@ jobs:
         shell: bash
         run: bash packaging/make-installer.sh
 
+      # ── pkg 签名（macOS only，P2；Secret 未配则跳过降级）──
+      - name: Sign pkg (macOS only)
+        if: runner.os == 'macOS' && secrets.MACOS_SIGNING_IDENTITY != ''
+        shell: bash
+        env:
+          MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
+        run: |
+          PKG="$(ls dist/artifacts/EMRG-*-macos-*.pkg | head -1)"
+          if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi
+          productsign --sign "$MACOS_SIGNING_IDENTITY" "$PKG" "${PKG}.signed"
+          mv "${PKG}.signed" "$PKG"
+          pkgutil --check-signature "$PKG" || true
+
       # ── 冒烟（§12，临时 HOME + 无 Python runner）────────────
       - name: Smoke test (R42 temp HOME)
         shell: bash

emrg/gui/package.json

@@ -41,6 +41,7 @@
     "icon": "../packaging/assets/",
     "mac": {
       "identity": null,
+      "hardenedRuntime": true,
       "target": [
         {
           "target": "dir",