fix(launcher): stronger self-heal — clear all attrs + ad-hoc codesign

The '(null)' double-click error is the macOS symptom of a missing execute
bit (and, on hardened Gatekeeper, an unsigned bundle). Make the first-run
self-heal exhaustive: chmod -R +x the whole MacOS dir, xattr -cr to strip
every download attribute (not just quarantine), and ad-hoc codesign the
bundle (sign -, no certificate) so a normal double-click is accepted
afterwards.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: 2 people

VolScope.app/Contents/MacOS/VolScope

@@ -25,10 +25,13 @@ RES_DIR="$APP_DIR/Contents/Resources"
 # quarantine flag, which makes a fresh double-click fail with
 # '…does not have permission to open "(null)"'. Re-set both here, so AFTER
 # this first (Terminal-launched) run, double-clicking VolScope.app just works.
-chmod +x "$MACOS_DIR/VolScope" 2>/dev/null || true
+chmod -R +x "$APP_DIR/Contents/MacOS" 2>/dev/null || true
 [ -f "$REPO/Start VolScope.command" ] && chmod +x "$REPO/Start VolScope.command" 2>/dev/null || true
-xattr -dr com.apple.quarantine "$APP_DIR" 2>/dev/null || true
-xattr -dr com.apple.quarantine "$REPO/Start VolScope.command" 2>/dev/null || true
+xattr -cr "$APP_DIR" 2>/dev/null || true                     # clear ALL attrs (incl. quarantine)
+xattr -c "$REPO/Start VolScope.command" 2>/dev/null || true
+# Ad-hoc code-sign the bundle (no certificate needed) so Gatekeeper accepts
+# the unsigned app on a normal double-click after this first run.
+codesign --force --deep --sign - "$APP_DIR" 2>/dev/null || true
 
 LOG_DIR="$HOME/Library/Logs/VolScope"
 mkdir -p "$LOG_DIR"