desktop-release: architecture guard before signing (tauri build --no-sign, guard, then tauri bundle signs / notarizes): every Mach-O in the app must contain arm64, nothing Intel-only, Info.plist must not force Intel (LSRequiresNativeExecution false, LSArchitecturePriority x86_64 first); guard repeated on the signed app, the DMG and the updater bundle, recorded in evidence.json

docs/desktop-release.md

@@ -84,7 +84,13 @@ What it does, in order:
      the script notarizes the DMG.
    - **None found**: an ad-hoc signed build whose files end in `-unsigned`.
 3. Builds the sidecars for arm64 and x64, merges them into one universal file with `lipo`, then runs
-   `tauri build --target universal-apple-darwin --bundles app` with the path-free environment.
+   `tauri build --target universal-apple-darwin --bundles app --no-sign` with the path-free environment. Then the
+   **architecture guard** on that unsigned app: every Mach-O file in the bundle (Contents/MacOS, Frameworks,
+   Resources: main binary, sidecar, helpers, dylibs) must contain arm64 (`lipo -archs`), nothing may be Intel-only,
+   and Info.plist must not set `LSRequiresNativeExecution` false or put x86_64 first in `LSArchitecturePriority`.
+   Users must never see macOS's "App Update Required ... will not open in macOS 28" (Rosetta) notice. Only then does
+   `tauri bundle` sign, notarize and staple the same binaries. The guard runs again on the signed app, the app in the
+   DMG and the one in the updater bundle, and its lines go into evidence.json.
 4. Makes the updater bundle (`.app.tar.gz`, root-owned entries, no macOS metadata) and the DMG. The DMG is made with
    `hdiutil` only (no Finder scripting, nothing comes to the front).
 5. **Checks the exact artifacts:**