Native CI-only arm (Darwin + GITHUB_ACTIONS) proving a real user route:
install the actual signed OLD release zip into an isolated .app location,
verify codesign/team/version/stamp against the parent resolver's
normalized manifest, configure updates.desktop_feed_base_url at a
loopback-only static feed built from the actual signed NEW zip in the
production update-feed contract (update-feed.cjs darwinFeed layout,
per-arch <arch>-stable-mac.yml), click the real About -> Update now under
Playwright, and let the detached external watcher own the automatic
relaunch proof: old pid exits, a NEW pid/birth appears at the same
installed path with no driver launch, the swapped bundle re-verifies
against the NEW manifest side, the relaunched backend answers
/api/health, and isolated user state + plugin fixtures survive.
No internal apply calls, no source artifacts, no re-signing, no public
feed writes; Squirrel.Mac's signature gate stays in charge.
17a81734e8