[lott-ai]

The published v0.5.0 macOS executable has an invalid embedded signature. macOS kills it with SIGKILL (Code Signature Invalid) before the CLI starts, so an alias from brew to brewlock blocks Homebrew commands.

Share the build path and apply an ad hoc signature to the final macOS executable before strict verification and packaging. Add compiled CLI checks for help, argument forwarding, stdout/stderr, successful and failing exit status, and an unchanged lock file. CI runs these checks, and release builds repeat them after extracting the tarball. Update the runtime pins to Bun 1.4.3 and prepare v0.5.1.

Validation:

• The new check rejects a fresh build from the previous Bun 1.3.6 build command with an invalid signature.
• Bun 1.4.3: lint, typecheck, and all 220 tests pass.
• Development and release binaries pass signature verification and compiled CLI checks.
• The extracted macOS tarball passes the same checks.
• The verified installed v0.5.0 binary was repaired locally; help and outdated now succeed.