Merge origin/main into feat/7css-skin

Brings in 6c05e39 (re-sign electrobun's CLI binary so the app launches).

Two conflicts, both resolved to keep both sides:
- package.json: start keeps scripts/start.ts (injects the Linux NVIDIA env)
  behind main's fix-electrobun-cli re-sign; build and postinstall take
  main's re-sign step (the resize watchdog is already gone).
- docs/build-and-release.md: the release usage keeps the linux-x64 target
  and gains main's fix-electrobun-cli step.

scripts/release.ts and docs/gotchas.md auto-merged with both sides intact:
the Linux target + tarball wrapper, and the arm64/x64 CLI re-sign.

Co-Authored-By: Claude <noreply@anthropic.com>

scripts/release.ts

@@ -9,6 +9,7 @@
 import { cpSync, existsSync, mkdirSync, readdirSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { ensureSigned } from "./fix-electrobun-cli";
 
 const ROOT = path.join(import.meta.dir, "..");
 const TARGETS = ["mac-arm64", "mac-x64", "win-x64", "linux-x64"] as const;
@@ -55,6 +56,7 @@ const viaRosetta = requested === "mac-x64" && process.arch === "arm64";
 // ---- prepare: version, icons, UI bundle ----
 
 run(["bun", "scripts/gen-version.ts"]);
+run(["bun", "scripts/fix-electrobun-cli.ts"]);
 run(["bun", "scripts/gen-icons.ts"]);
 run(["bun", "run", "--cwd", "ui", "build"]);
 
@@ -68,7 +70,12 @@ async function x64Cli(): Promise<string> {
 	const pkg = await Bun.file(path.join(ROOT, "node_modules", "electrobun", "package.json")).json();
 	const dir = path.join(os.homedir(), ".cache", "miniscp", `electrobun-cli-x64-${pkg.version}`);
 	const bin = path.join(dir, "electrobun");
-	if (existsSync(bin)) return bin;
+	// Same broken upstream ad-hoc signature as the arm64 CLI (see
+	// scripts/fix-electrobun-cli.ts) — unsigned it is SIGKILLed on exec.
+	if (existsSync(bin)) {
+		if (!ensureSigned(bin)) fail(`x64 CLI at ${bin} has an unusable code signature`);
+		return bin;
+	}
 	console.log(`[release] downloading electrobun x64 CLI ${pkg.version} (one-time)…`);
 	mkdirSync(dir, { recursive: true });
 	const url = `https://github.com/blackboardsh/electrobun/releases/download/v${pkg.version}/electrobun-cli-darwin-x64.tar.gz`;
@@ -77,6 +84,7 @@ async function x64Cli(): Promise<string> {
 	run(["tar", "-xzf", tarball, "-C", dir]);
 	if (!existsSync(bin)) fail(`x64 CLI tarball did not contain "electrobun" (${dir})`);
 	run(["chmod", "+x", bin]);
+	if (!ensureSigned(bin)) fail(`x64 CLI at ${bin} has an unusable code signature`);
 	return bin;
 }