fix: exclude cli-bundle from Node.js re-signing to prevent runtime issues

The cli-bundle/node is already signed by bundle-runtime.sh with ad-hoc
signature. Re-signing it with Developer ID in CI causes the Node.js
runtime to fail when spawned by Rust.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

.github/workflows/build.yml

@@ -203,8 +203,9 @@ jobs:
           find "$APP_BUNDLE" -type f \( -name "*.node" -o -name "*.dylib" \) -print0 | xargs -0 xattr -cr 2>/dev/null || true
 
           # Sign all .node files with Developer ID, timestamp, and hardened runtime
+          # But skip cli-bundle/node which is already signed by bundle-runtime.sh
           echo "  Signing .node files..."
-          find "$APP_BUNDLE" -type f -name "*.node" -print0 | xargs -0 codesign --force --sign "$SIGN_ID" --options runtime --timestamp || true
+          find "$APP_BUNDLE" -type f -name "*.node" -not -path "*/cli-bundle/*" -print0 | xargs -0 codesign --force --sign "$SIGN_ID" --options runtime --timestamp || true
 
           # Sign all .dylib files with Developer ID, timestamp, and hardened runtime
           echo "  Signing .dylib files..."