feat(release): production Apple builds — notarized macOS dmg + iOS TestFlight

release.yml (v* tags / dispatch, macos-arm64 runner): universal mac +
iOS xcframework -> xcodebuild archive -> Developer ID export ->
notarytool + staple -> dmg on the Gitea release; iOS archive uploads
to TestFlight (app-store-connect/upload). Per-run throwaway keychain;
ASC API key authenticates notarization, upload, and automatic-signing
profile fetch. macOS App Store lane deferred (needs App Sandbox);
tvOS deferred (tier-3 Rust targets).

All app targets now share bundle ID io.unom.punktfunk — ONE App Store
listing with universal purchase (decided pre-submission; effectively
unchangeable after). ITSAppUsesNonExemptEncryption=false declared
(standard-algorithm AES-GCM, exempt).

build-xcframework.sh resolves Apple toolchains itself: cargo's HOST
artifacts (proc-macros, build scripts) are loaded by the running OS,
and a newer-than-OS beta Xcode ld emits LINKEDIT layouts dyld rejects
("mis-aligned LINKEDIT string pool" -> misleading E0463) — so prefer
a non-beta Xcode for everything, fall back to CLT for mac-only slices
(env untouched: an explicit DEVELOPER_DIR=<CLT> trips xcrun's license
check), refuse iOS/tvOS without a real Xcode (CLT has no iOS SDK).
The runner plist no longer injects DEVELOPER_DIR for the same reason.

punktfunk_Logo.icon: dropped the Xcode-27-beta-only Icon Composer
features (refractivity, specular-location) — 26.5's actool crashes on
them, and store builds must use release Xcode. Visual delta is the
refraction/specular nuance only; re-author when 27 ships.

Validated on home-mac-mini-1 with Xcode 26.5: mac+iOS xcframework
slices, unified bundle IDs, signing-free app build.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/ci/setup-macos-runner.sh

@@ -91,20 +91,10 @@ fi
 # runner ships as a root LaunchDaemon; installing it needs sudo once. Without sudo this
 # script still leaves a working (but reboot-volatile) nohup daemon behind.
 # PATH must carry the CLT tools, cargo, node and act_runner itself; jobs inherit it.
-# If the system developer dir is CLT-only but a full Xcode is installed, hand jobs a
-# DEVELOPER_DIR override — the per-process equivalent of `xcode-select -s`, no sudo needed.
-DEVELOPER_DIR_XML=""
-DEV_DIR=""
-if ! /usr/bin/xcodebuild -version >/dev/null 2>&1; then
-    for app in /Applications/Xcode.app /Applications/Xcode*.app; do
-        if DEVELOPER_DIR="$app/Contents/Developer" /usr/bin/xcodebuild -version >/dev/null 2>&1; then
-            DEV_DIR="$app/Contents/Developer"
-            DEVELOPER_DIR_XML="<key>DEVELOPER_DIR</key><string>$DEV_DIR</string>"
-            echo "==> using full Xcode at $app via DEVELOPER_DIR"
-            break
-        fi
-    done
-fi
+# Deliberately NO DEVELOPER_DIR here: cargo (rust ld) must stay on the system default —
+# a newer-than-OS Xcode's ld emits dylibs the running dyld rejects ("mis-aligned
+# LINKEDIT string pool"), breaking every proc-macro build. Steps that need a full Xcode
+# (xcodebuild) resolve it themselves (build-xcframework.sh, release.yml).
 
 PLIST_STAGE="$RUNNER_HOME/io.gitea.act_runner.plist"
 PLIST_SYSTEM="/Library/LaunchDaemons/io.gitea.act_runner.plist"
@@ -128,7 +118,6 @@ cat > "$PLIST_STAGE" <<EOF
         <key>PATH</key>
         <string>$HOME/.cargo/bin:$BIN_DIR:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
         <key>HOME</key><string>$HOME</string>
-        $DEVELOPER_DIR_XML
     </dict>
     <key>RunAtLoad</key><true/>
     <key>KeepAlive</key><true/>
@@ -150,7 +139,6 @@ else
         echo "==> no sudo: starting an interim daemon (dies on reboot)"
         (cd "$RUNNER_HOME" && \
             PATH="$HOME/.cargo/bin:$BIN_DIR:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin" \
-            ${DEV_DIR:+DEVELOPER_DIR="$DEV_DIR"} \
             nohup "$BIN_DIR/act_runner" daemon --config config.yaml >> runner.log 2>&1 &)
     fi
     echo "==> for the permanent (reboot-safe) runner, run once on the Mac:"
@@ -161,9 +149,8 @@ fi
 sleep 2
 tail -5 "$RUNNER_HOME/runner.log" 2>/dev/null || true
 
-if ! /usr/bin/xcodebuild -version >/dev/null 2>&1 && [ -z "$DEVELOPER_DIR_XML" ]; then
-    echo "WARNING: xcodebuild not usable (Command Line Tools only, no full Xcode found) —"
-    echo "         apple.yml's xcframework step needs a full Xcode in /Applications, with"
-    echo "         its license accepted once: sudo xcodebuild -license accept"
+if ! /usr/bin/xcodebuild -version >/dev/null 2>&1 && ! ls -d /Applications/Xcode*.app >/dev/null 2>&1; then
+    echo "WARNING: no full Xcode found — the xcframework/release steps need one in"
+    echo "         /Applications, with its license accepted once: sudo xcodebuild -license accept"
 fi
 echo "OK: runner '$RUNNER_NAME' labels=$LABELS instance=$INSTANCE"