feat(#1108): upload the macOS build and ship it as a release asset

CI has built macOS on every run since the matrix landed and thrown the
result away, while a macOS user runs the iOS TestFlight build instead
(#1105). build.yml now zips the .app (ditto, symlink-safe) and uploads
it like the other platforms, gaining the dart-defines parity the macos
job alone lacked; release-signed.yml gains an unsigned macos job whose
offband-macos.zip becomes a blocking release asset. Signing and
notarization follow in #1109.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -247,11 +247,35 @@ jobs:
         if: needs.classify.outputs.docs_only != 'true'
       - run: dart run build_runner build --delete-conflicting-outputs
         if: needs.classify.outputs.docs_only != 'true'
+      - name: Write dart_defines.json
+        if: needs.classify.outputs.docs_only != 'true'
+        env:
+          GIPHY_API_KEY: ${{ secrets.GIPHY_API_KEY }}
+        run: jq -n --arg k "$GIPHY_API_KEY" '{GIPHY_API_KEY:$k}' > dart_defines.json
       - name: Enable native assets (bundles sqlite3 + llamadart libs, #445)
         if: needs.classify.outputs.docs_only != 'true'
         run: flutter config --enable-native-assets
-      - run: flutter build macos --release --no-pub
+      - run: flutter build macos --release --no-pub --dart-define-from-file=dart_defines.json
+        if: needs.classify.outputs.docs_only != 'true'
+      # ditto, not zip: it preserves the .app bundle's symlinks, which plain
+      # zip flattens into copies that break code-signing validation (#1108).
+      # lipo output is informational: whether the build plus native assets
+      # comes out universal or arm64-only is recorded here, not assumed.
+      - name: Zip macOS app
         if: needs.classify.outputs.docs_only != 'true'
+        run: |
+          set -eu
+          APP=build/macos/Build/Products/Release/offband_meshcore.app
+          lipo -archs "${APP}/Contents/MacOS/offband_meshcore" || true
+          ditto -c -k --keepParent "${APP}" offband-macos.zip
+      - name: Upload macOS build
+        if: needs.classify.outputs.docs_only != 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: offband-macos-r${{ github.run_number }}-${{ github.event.pull_request.head.sha || github.sha }}
+          path: offband-macos.zip
+          if-no-files-found: error
+          retention-days: 14
 
   web:
     runs-on: ubuntu-latest

.github/workflows/release-signed.yml

@@ -1,8 +1,8 @@
 name: Release (signed, all platforms)
 
 # Produces a COMPLETE, published release from a `v*` tag: signed Android APK +
-# AAB, Windows, and Linux, attached to a GitHub release whose body is the
-# human-authored release notes. This is what makes a partial release (the
+# AAB, Windows, Linux, and macOS (unsigned until #1109), attached to a GitHub
+# release whose body is the human-authored release notes. This is what makes a partial release (the
 # rc.2/rc.3 failure) impossible.
 #
 # SECURITY: this repo is PUBLIC and the `android` job has the signing keystore,
@@ -250,6 +250,42 @@ jobs:
           if-no-files-found: error
           retention-days: 7
 
+  # Unsigned (ad-hoc) macOS build, distributed as a release asset (#1108).
+  # No Apple service is involved, so unlike `ios` it blocks the release like
+  # the other desktop jobs. Developer ID signing + notarization is #1109.
+  macos:
+    needs: gate
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: subosito/flutter-action@v2
+        with:
+          flutter-version: "3.44.1"
+          cache: true
+      - run: flutter pub get
+      - run: dart run build_runner build --delete-conflicting-outputs
+      - name: Write dart_defines.json
+        env:
+          GIPHY_API_KEY: ${{ secrets.GIPHY_API_KEY }}
+        run: jq -n --arg k "$GIPHY_API_KEY" '{GIPHY_API_KEY:$k}' > dart_defines.json
+      - name: Enable native assets (bundles sqlite3 + llamadart libs, #445)
+        run: flutter config --enable-native-assets
+      - run: flutter build macos --release --no-pub --dart-define-from-file=dart_defines.json
+      # ditto, not zip: it preserves the .app bundle's symlinks, which plain
+      # zip flattens into copies that break code-signing validation (#1108).
+      - name: Zip macOS app
+        run: |
+          set -eu
+          APP=build/macos/Build/Products/Release/offband_meshcore.app
+          lipo -archs "${APP}/Contents/MacOS/offband_meshcore" || true
+          ditto -c -k --keepParent "${APP}" offband-macos.zip
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-macos
+          path: offband-macos.zip
+          if-no-files-found: error
+          retention-days: 7
+
   # Uploads to App Store Connect (#1039). Deliberately not in `release`'s needs:
   # an Apple-side failure must not block the Android and desktop release.
   ios:
@@ -261,7 +297,7 @@ jobs:
   # check) have passed, so a signing failure yields no release rather than an
   # empty one. Published directly: the notes were reviewed in the cut PR.
   release:
-    needs: [android, windows, linux]
+    needs: [android, windows, linux, macos]
     runs-on: ubuntu-latest
     permissions:
       contents: write   # create the release + upload assets
@@ -285,6 +321,7 @@ jobs:
           cp incoming/release-android/* out/
           cp incoming/release-windows/* out/
           cp incoming/release-linux/* out/
+          cp incoming/release-macos/* out/
           echo "Assets for the release:"
           ls -la out/
       # Draft-first so publication is ATOMIC: the release is not visible to