Adds .metadata_never_index to staging dir and retries hdiutil create up to 3 times to handle transient "Resource busy" failures from Spotlight/fseventsd locking the source folder. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Enables distributing Galaxy.app to end users without Gatekeeper warnings. Uses Samsung Developer ID Application certificate with hardened runtime. Pipeline: cargo bundle → sign.sh → notarize.sh → package.sh → Galaxy.dmg Entitlements: - network.client (AWS Bedrock API calls) - automation.apple-events (osascript for CLI install) - cs.allow-unsigned-executable-memory (Metal shader compilation) Orchestration scripts: - build-debug.sh: full pipeline with debug build - build-release.sh: full pipeline with release build Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
