Merge origin/main into feat/7css-skin

Brings in 6c05e39 (re-sign electrobun's CLI binary so the app launches).

Two conflicts, both resolved to keep both sides:
- package.json: start keeps scripts/start.ts (injects the Linux NVIDIA env)
  behind main's fix-electrobun-cli re-sign; build and postinstall take
  main's re-sign step (the resize watchdog is already gone).
- docs/build-and-release.md: the release usage keeps the linux-x64 target
  and gains main's fix-electrobun-cli step.

scripts/release.ts and docs/gotchas.md auto-merged with both sides intact:
the Linux target + tarball wrapper, and the arm64/x64 CLI re-sign.

Co-Authored-By: Claude <noreply@anthropic.com>

docs/gotchas.md

@@ -79,6 +79,21 @@ touching the adjacent code.
 
 ## Electrobun
 
+- **The prebuilt CLI binary ships with a broken ad-hoc signature**, so macOS
+  SIGKILLs it at exec and `bun run start` prints nothing and exits **0** —
+  `bin/electrobun.cjs` spawns the real binary and forwards
+  `process.exit(code || 0)`, and a signal death has `code === null`. The binary
+  is a Bun single-file executable whose payload is appended *after* the linker
+  signed it, so `codesign -v` reports "code or signature have been modified";
+  the arm64 and x64 CLI tarballs are both affected upstream (confirmed by
+  hashing a fresh download against the shipped copy — it is not local
+  corruption, and re-installing does not help). `scripts/fix-electrobun-cli.ts`
+  re-seals it with `codesign --force --sign -`. It runs from `postinstall`
+  **and** ahead of every electrobun invocation, because the wrapper downloads
+  the binary **lazily on first use**, not at install time — postinstall alone
+  would no-op on a fresh checkout. It also fixes `.cache/electrobun`, which the
+  wrapper restores `bin/` from. Never read a silent `exit 0` from the
+  electrobun CLI as "nothing happened": run `codesign -v` on it first.
 - **Window `close` is not cancellable** (response type `{}`; only the
   app-level `before-quit` supports `event.response = {allow:false}`). All
   unsaved-state guards must either intercept app-controlled close paths