chore(mas): pin masDev identity to Apple Development cert SHA-1

[mrangelmarino]

⚠️ DO NOT MERGE until #487 Apple provisioning steps are done and the masDev launch is verified locally (error 163 gone). See checklist below.

Summary

Pins masDev.identity from the bare string Apple Development to the SHA-1 fingerprint of the existing valid Apple Development cert for the MAS team 8PT2Y7QQ2F:

5106DA8B43E1AF25E3B553CABD91400445A9E68A

(Cert: CN=Apple Development: ANGEL MARINO (2Y3M2V2Q5F), OU=8PT2Y7QQ2F, valid through 2027-03-18)

The bare Apple Development string already resolves to this cert on the current keychain — this is defensive hygiene to remove ambiguity if a second Apple Development cert is ever added.

Why this is not the fix for error 163

The root cause of error 163 is a missing or stale build/Prose_Development.provisionprofile — the profile must embed:

• The 8PT2Y7QQ2F Apple Development cert (SHA-1 above)
• This Mac (Provisioning UDID: 00006040-0004482A0187801C)
• The App Groups capability (8PT2Y7QQ2F.ist.solo.prose)

Until those provisioning steps are done, rebuilding with this pin will still yield error 163.

Pending human steps (before this PR can be merged and verified)

1. Confirm/register this Mac under team 8PT2Y7QQ2F in the Apple Developer portal:
   • Devices → + → Platform macOS → Provisioning UDID 00006040-0004482A0187801C
2. Regenerate build/Prose_Development.provisionprofile for ist.solo.prose under 8PT2Y7QQ2F, embedding:
   • The existing Apple Development cert (SHA-1 5106DA8B43E1AF25E3B553CABD91400445A9E68A)
   • This Mac device
   • App Groups capability 8PT2Y7QQ2F.ist.solo.prose
   • Download and replace build/Prose_Development.provisionprofile
3. Run npx electron-builder --mac mas-dev and verify the app launches without error 163.
4. Then merge this PR.

Refs #487

[mrangelmarino]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[mrangelmarino]

/review

Auto-triggered after E2E tests passed.

[claude]

Security note: This PR modifies electron-builder.yml, an Electron privilege-boundary file governing code signing configuration. Full human review is required regardless of other findings.

Code Review

Electron Security Checklist

• nodeIntegration — not touched
• contextIsolation — not touched
• No new preload APIs
• No shell.openExternal changes
• No IPC handler changes
• No secrets or API keys hardcoded — the SHA-1 is the public fingerprint of the signing cert, not the private key; safe to commit
• No new dependencies
• CSP not touched

---

Change: masDev.identity pinned from bare string "Apple Development" to SHA-1 fingerprint 5106DA8B43E1AF25E3B553CABD91400445A9E68A.

Correctness: Sound. electron-builder accepts either form; the fingerprint is the more precise selector and eliminates ambiguity if a second Apple Development cert is ever added to the keychain. The mas distribution target is unaffected. The PR description is clear that this change is defensive hygiene, not the fix for error 163 — the real blocker is a missing/stale provisioning profile.

One minor note: The cert expires 2027-03-18. When it rotates, this fingerprint will silently cause signing to fail on that target until updated. Not a blocker, but consider a comment like # cert expires 2027-03-18, update when rotated inline in the YAML so the breakage is easier to trace.

No bugs, security issues, or other concerns with the change itself.

[github-actions]

✅ Ready to Merge

Code review found no significant issues. This PR is ready for human approval and merge.