fix(client/macos): CI 重签 sysext entitlements 补 network.client/server + 闸断言

v1.1.2 事故第二弹:inside-out 重签的 sysext heredoc 漏了
com.apple.security.network.client/server —— 沙箱扩展无权对外建连,
隧道起了也连不上节点(本地 Xcode 直签用仓库 PacketTunnel.entitlements
带这两键,故 local_test 流程正常,唯 CI 包不通)。

- compile-macos.sh / local_test.sh cmd_sign:sysext heredoc 补两键(与仓库源文件对齐)
- 公证前一致性闸扩展:断言 sysext 最终签名 network.client/server=true,重签丢键即 fail
- 已本地验证:对 v1.1.2 发布包用新 entitlements 重签,读回签名两键在位

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD

scripts/ci/compile-macos.sh

@@ -225,6 +225,10 @@ cat > "${WORK}/sysext.entitlements" <<PLIST
 	<key>com.apple.developer.networking.networkextension</key>
 	<array><string>packet-tunnel-provider-systemextension</string></array>
 	<key>com.apple.security.app-sandbox</key><true/>
+	<!-- 沙箱 sysext 必须显式网络权限才能对外建连/收发(同仓库 PacketTunnel.entitlements)。
+	     曾漏掉这两键 → 隧道扩展被沙箱拒绝出站,连不上节点(v1.1.2 事故,连上隧道但不通)。 -->
+	<key>com.apple.security.network.client</key><true/>
+	<key>com.apple.security.network.server</key><true/>
 	<key>com.apple.security.application-groups</key>
 	<array><string>${APP_GROUP}</string></array>
 </dict></plist>
@@ -275,6 +279,12 @@ case "$MACH" in
   "${APP_GROUP}"*) ;;
   *) echo "ERROR: NEMachServiceName(${MACH:-<missing>}) 必须以 App Group(${APP_GROUP}) 为前缀，否则 sysextd 校验失败 Code=6" >&2; exit 1 ;;
 esac
+# 沙箱 sysext 无 network.client/server = 无权对外建连 → 隧道起了也连不上节点(v1.1.2 事故)。
+SE_NC="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.client' "${WORK}/se.signed.plist" 2>/dev/null || true)"
+SE_NS="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.server' "${WORK}/se.signed.plist" 2>/dev/null || true)"
+echo "    sysext network.client=${SE_NC:-<missing>} network.server=${SE_NS:-<missing>}"
+[ "$SE_NC" = "true" ] || { echo "ERROR: sysext 缺 com.apple.security.network.client —— 沙箱扩展无权出站,隧道连不上节点" >&2; exit 1; }
+[ "$SE_NS" = "true" ] || { echo "ERROR: sysext 缺 com.apple.security.network.server" >&2; exit 1; }
 echo "    OK: ${APP_GROUP}"
 
 # ── [7/7] 公证(notarytool，API key 三件套) + staple + 打包 ──────────────────

scripts/local_test.sh

@@ -112,6 +112,10 @@ PLIST
 	<key>com.apple.developer.networking.networkextension</key>
 	<array><string>packet-tunnel-provider-systemextension</string></array>
 	<key>com.apple.security.app-sandbox</key><true/>
+	<!-- 沙箱 sysext 必须显式网络权限才能对外建连(同仓库 PacketTunnel.entitlements;
+	     v1.1.2 CI 重签漏掉这两键 → 隧道连不上节点)。 -->
+	<key>com.apple.security.network.client</key><true/>
+	<key>com.apple.security.network.server</key><true/>
 	<key>com.apple.security.application-groups</key>
 	<array><string>${APP_GROUP}</string></array>
 </dict></plist>
@@ -142,6 +146,13 @@ verify_app_group(){
     "$APP_GROUP"*) ;;
     *) die "NEMachServiceName($mach)必须以 App Group($APP_GROUP)为前缀,否则 sysextd 校验失败 Code=6" ;;
   esac
+  # 沙箱 sysext 无 network.client/server = 无权对外建连 → 隧道起了也连不上节点(v1.1.2 事故)。
+  local se_nc se_ns
+  se_nc="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.client' "$WORK/se.ents.plist" 2>/dev/null || true)"
+  se_ns="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.network.server' "$WORK/se.ents.plist" 2>/dev/null || true)"
+  echo "  sysext network.client=${se_nc:-<缺失>} network.server=${se_ns:-<缺失>}"
+  [ "$se_nc" = "true" ] || die "sysext 缺 com.apple.security.network.client —— 沙箱扩展无权出站,隧道连不上节点"
+  [ "$se_ns" = "true" ] || die "sysext 缺 com.apple.security.network.server"
   echo "  ✅ 一致($APP_GROUP)"
 }