fix: embed and sign the openlogi CLI in the macOS app bundle

[mvanhorn]

Summary

Fixes #328. The macOS .app bundle now includes the openlogi CLI binary, so it is present in the release the same way it is in the Linux package and where the Homebrew cask's binary stanza expects it (Contents/MacOS/openlogi).

Why this matters

The macOS bundle step only embedded openlogi-gui, so the CLI was absent from the shipped .app. Users installing the macOS release had no openlogi command, while Linux users did. The fix mirrors the existing agent-helper embedding so the CLI ships alongside the GUI.

Changes

• xtask/.../macos/bundle.rs: add embed_cli, which builds openlogi --release and copies it into Contents/MacOS/openlogi, mirroring embed_agent_helper. Add verify_bundle_binaries, called at the end of run(), asserting both openlogi and openlogi-gui are present so a future regression fails the build loudly (unit-tested against a temp dir, no Xcode toolchain required).
• Signing: the embedded CLI is a second Mach-O under Contents/MacOS, so it needs its own hardened-runtime signature before the outer app or notarization rejects its as-built ad-hoc signature. sign_app now signs (and verifies) the CLI in the same inside-out order it uses for the agent helper, and the release workflow's signing step does the same, so tagged notarized builds stay valid.

Testing

cargo build -p xtask, cargo test -p xtask (5 passing, including the new verify_bundle_binaries cases), and cargo clippy -p xtask all pass. Running xtask macos bundle locally produces an OpenLogi.app containing both openlogi and openlogi-gui. The codesign/notarization steps run only in the tagged release workflow (they need the signing certificate), so those were reviewed against the existing agent-helper signing pattern rather than executed here.

[greptile-apps]

Greptile Summary

This PR embeds the macOS CLI into the app bundle and signs it for release. The main changes are:

• Build and copy openlogi into Contents/MacOS/openlogi during bundling.
• Verify that both openlogi and openlogi-gui exist in the bundle.
• Sign and verify the embedded CLI before signing the outer app.
• Add unit tests for required bundle binaries.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Adds CLI signing and verification to the macOS release workflow before the outer app is signed.
xtask/src/commands/macos/bundle.rs	Adds CLI embedding, required binary checks, CLI signing, and tests for bundle binary verification.

_{Reviews (1): Last reviewed commit: "ci(release): sign the embedded CLI in th..." | Re-trigger Greptile}