fix: fix ordering - sign app bundle before rebuilding DMG

The app bundle must be signed BEFORE the DMG is rebuilt, not after.
Move the deep signing step to before the DMG rebuild step.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

.github/workflows/build.yml

@@ -193,15 +193,6 @@ jobs:
 
           echo "✅ Fallback signing complete"
 
-      - name: Rebuild DMG with signed binaries
-        run: |
-          # Remove old DMG
-          rm -f ./lumis/apps/web/src-tauri/target/release/bundle/dmg/Lumis*.dmg
-
-          # Rebuild DMG using Tauri (which will use the already signed app bundle)
-          cd ./lumis/apps/web
-          pnpm tauri build --bundles dmg
-
       - name: Sign app bundle with Developer ID (deep)
         env:
           APPLE_SIGNING_IDENTITY: "${{ secrets.APPLE_SIGNING_IDENTITY }}"
@@ -212,6 +203,15 @@ jobs:
           codesign --deep --force --sign "$APPLE_SIGNING_IDENTITY" --options runtime --timestamp "$APP_BUNDLE"
           echo "✅ App bundle deep signed"
 
+      - name: Rebuild DMG with signed binaries
+        run: |
+          # Remove old DMG (the app bundle is now properly signed)
+          rm -f ./lumis/apps/web/src-tauri/target/release/bundle/dmg/Lumis*.dmg
+
+          # Rebuild DMG using Tauri (which will use the already signed app bundle)
+          cd ./lumis/apps/web
+          pnpm tauri build --bundles dmg
+
       - name: Sign DMG with Developer ID
         env:
           APPLE_SIGNING_IDENTITY: "${{ secrets.APPLE_SIGNING_IDENTITY }}"