fix(client/macos): CI 重签 App Group 修回 macOS 原生格式 + 公证前一致性闸

compile-macos.sh 的 sysext entitlements 曾硬编码 iOS 风格 group. 前缀,且主 app
entitlements 缺 application-groups —— 与 NEMachServiceName 前缀对不上,
nesessionmanager 报 Code=6,sysextd 当场卸载新扩展,线上包永远建不出 VPN 配置
(本地 Xcode 直签流程正常,故长期未察觉;详见 todo #28)。

- compile-macos.sh: 两处 entitlements 改用 ${APP_GROUP};公证前加一致性闸
  (读最终签名核对 app/sysext App Group 与 NEMachServiceName 前缀,不一致即 fail)
- local_test.sh: 同款修复 + verify_app_group 闸 + cmd_bump_build 自动递增
  sysext 构建号 + macos 一条龙子命令(bump→build→闸→公证→装→跑)
- pbxproj: CURRENT_PROJECT_VERSION 53→55(本地已构建两次,保持单调)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD

scripts/ci/compile-macos.sh

@@ -192,6 +192,12 @@ SE="${APP}/Contents/Library/SystemExtensions/${SYSEXT_BUNDLE_ID}.systemextension
 [ -d "$SE" ]  || { echo "ERROR: sysext bundle not found: ${SE}" >&2; exit 1; }
 
 # ── [6/7] inside-out 重签（sysext → app frameworks → app），同 local_test.sh cmd_sign ──
+# ⚠️ 这两份 entitlements 是最终产物的**真相源**——codesign --force 会覆盖 Xcode 用
+# 仓库 .entitlements 打的签名。两边的 application-groups 必须同为 ${APP_GROUP}
+# （macOS 原生格式 <TeamID>.<name>，见 CLAUDE.md），且 sysext Info.plist 的
+# NEMachServiceName 必须以它为前缀。曾因这里硬编码成 iOS 的 group. 前缀，导致
+# nesessionmanager 报 NetworkExtensionErrorDomain Code=6、sysextd 校验失败当场
+# 卸载新扩展，客户端永远建不出 VPN 配置（见 todo #28）。改这里请同步 local_test.sh。
 cat > "${WORK}/app.entitlements" <<PLIST
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -204,6 +210,8 @@ cat > "${WORK}/app.entitlements" <<PLIST
 	<key>com.apple.security.app-sandbox</key><false/>
 	<key>com.apple.security.network.client</key><true/>
 	<key>com.apple.security.network.server</key><true/>
+	<key>com.apple.security.application-groups</key>
+	<array><string>${APP_GROUP}</string></array>
 	<key>keychain-access-groups</key>
 	<array><string>${APP_GROUP}</string></array>
 </dict></plist>
@@ -218,7 +226,7 @@ cat > "${WORK}/sysext.entitlements" <<PLIST
 	<array><string>packet-tunnel-provider-systemextension</string></array>
 	<key>com.apple.security.app-sandbox</key><true/>
 	<key>com.apple.security.application-groups</key>
-	<array><string>group.com.pangolin.pangolin</string></array>
+	<array><string>${APP_GROUP}</string></array>
 </dict></plist>
 PLIST
 
@@ -249,6 +257,26 @@ codesign --force --options runtime --timestamp \
 codesign --verify --deep --strict --verbose=2 "$APP"
 echo "==> compile-macos: signed + verified (${IDENTITY})"
 
+# ── App Group / NEMachServiceName 一致性闸（读最终签名，不是仓库源文件）──────
+# 规则没上闸 = 没有规则：这道闸就是为 todo #28 那次事故立的，放在公证前，
+# 不一致直接 fail，避免把装不上的包公证并发出去。
+echo "==> compile-macos: verifying App Group / NEMachServiceName consistency"
+codesign -d --entitlements - --xml "$APP" > "${WORK}/app.signed.plist" 2>/dev/null || true
+codesign -d --entitlements - --xml "$SE"  > "${WORK}/se.signed.plist"  2>/dev/null || true
+APP_G="$(/usr/libexec/PlistBuddy -c 'Print :com.apple.security.application-groups:0' "${WORK}/app.signed.plist" 2>/dev/null || true)"
+SE_G="$(/usr/libexec/PlistBuddy  -c 'Print :com.apple.security.application-groups:0' "${WORK}/se.signed.plist"  2>/dev/null || true)"
+MACH="$(/usr/libexec/PlistBuddy  -c 'Print :NetworkExtension:NEMachServiceName' "${SE}/Contents/Info.plist" 2>/dev/null || true)"
+echo "    app App Group    : ${APP_G:-<missing>}"
+echo "    sysext App Group : ${SE_G:-<missing>}"
+echo "    NEMachServiceName: ${MACH:-<missing>}"
+[ "$APP_G" = "$APP_GROUP" ] || { echo "ERROR: app App Group 应为 ${APP_GROUP}，实为 ${APP_G:-<missing>}" >&2; exit 1; }
+[ "$SE_G"  = "$APP_GROUP" ] || { echo "ERROR: sysext App Group 应为 ${APP_GROUP}，实为 ${SE_G:-<missing>}" >&2; exit 1; }
+case "$MACH" in
+  "${APP_GROUP}"*) ;;
+  *) echo "ERROR: NEMachServiceName(${MACH:-<missing>}) 必须以 App Group(${APP_GROUP}) 为前缀，否则 sysextd 校验失败 Code=6" >&2; exit 1 ;;
+esac
+echo "    OK: ${APP_GROUP}"
+
 # ── [7/7] 公证(notarytool，API key 三件套) + staple + 打包 ──────────────────
 echo "==> compile-macos: notarizing (notarytool submit --wait, ~1-5min)"
 NOTARIZE_ZIP="${WORK}/notarize.zip"