Merge origin/main into feat/7css-skin

Brings in 6c05e39 (re-sign electrobun's CLI binary so the app launches).

Two conflicts, both resolved to keep both sides:
- package.json: start keeps scripts/start.ts (injects the Linux NVIDIA env)
  behind main's fix-electrobun-cli re-sign; build and postinstall take
  main's re-sign step (the resize watchdog is already gone).
- docs/build-and-release.md: the release usage keeps the linux-x64 target
  and gains main's fix-electrobun-cli step.

scripts/release.ts and docs/gotchas.md auto-merged with both sides intact:
the Linux target + tarball wrapper, and the arm64/x64 CLI re-sign.

Co-Authored-By: Claude <noreply@anthropic.com>

docs/build-and-release.md

@@ -22,13 +22,21 @@ semver-shaped (`0.1.<n>`) for electrobun's config/updater; `BRANDING.buildLabel`
 - `scripts/node-version-shim.ts` (preloaded via `bunfig.toml`, root AND ui/)
   fakes a Node version the Angular CLI accepts under Bun. Both preloads are
   load-bearing.
+- `scripts/fix-electrobun-cli.ts` re-signs electrobun's prebuilt CLI binary,
+  whose upstream ad-hoc signature is invalid — macOS SIGKILLs it and the app
+  silently never launches, with exit code 0 (see [gotchas.md](gotchas.md)). It
+  runs from `postinstall` **and** at the start of `dev`/`start`/`build`/
+  `release`, because the CLI is downloaded lazily on first use rather than at
+  install time; when the binary is missing it provokes that download first, so
+  a fresh checkout self-heals. Equally load-bearing — removing it means
+  `bun run start` does nothing at all.
 
 ## Release builds
 
 `bun scripts/release.ts [--target mac-arm64|mac-x64|win-x64|linux-x64]`
 (default: host).
-Steps: gen-version → gen-icons → Angular build → `electrobun build
---env=stable` → copy/rename artifacts into
+Steps: gen-version → fix-electrobun-cli → gen-icons → Angular build →
+`electrobun build --env=stable` → copy/rename artifacts into
 `release/<target>/miniSCP-Build<n>-<target>.*`.
 
 Facts the script encodes:
@@ -48,6 +56,10 @@ Facts the script encodes:
   `dist-macos-x64` core into the electrobun package dir on first use, and
   packages a genuine x64 app. Note: Bun's `fetch`→`Bun.write` streaming hung
   on the GitHub redirect chain; the script uses `curl -fsSL` deliberately.
+- **Both CLI binaries need re-signing.** The x64 CLI fetched for the Rosetta
+  path carries the same broken upstream signature as the arm64 one, so
+  `x64Cli()` re-signs it after download *and* on cache reuse; the native path
+  is covered by the `fix-electrobun-cli.ts` step up front.
 - **Core binary downloads**: the installed npm package ships mac-arm64
   binaries only; other `dist-<os>-<arch>` cores are fetched from
   `github.com/blackboardsh/electrobun/releases` at build time — network to