feat(client/macos): PacketTunnel 转 System Extension(构建通过)

macOS 站外加载隧道必须 sysext(appex 仅 App Store 可加载)。转换:
- productType app-extension→system-extension;产物 .appex→.systemextension
- 嵌入路径 PlugIns→Contents/Library/SystemExtensions(SYSTEM_EXTENSIONS_FOLDER_PATH)
- main.swift 入口(NEProvider.startSystemExtensionMode + dispatchMain;sysext 是
  可执行程序,需显式 main 而非 appex 的 NSExtensionMain)
- Info.plist 加 NEMachServiceName;entitlement 换回 packet-tunnel-provider-systemextension

CFBundlePackageType 自动 SYSX,Build Succeeded(关签名)。运行还需 Developer ID
签名 + systemextensionsctl developer on + OSSystemExtensionRequest 激活。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

client/macos/PacketTunnel/Info.plist

@@ -6,6 +6,8 @@
 	     GENERATE_INFOPLIST_FILE=YES 自动生成并合并,此处不重复写以免冲突。 -->
 	<key>NetworkExtension</key>
 	<dict>
+		<key>NEMachServiceName</key>
+		<string>$(TeamIdentifierPrefix)group.com.pangolin.pangolin</string>
 		<key>NEProviderClasses</key>
 		<dict>
 			<key>com.apple.networkextension.packet-tunnel</key>

client/macos/PacketTunnel/main.swift

@@ -0,0 +1,13 @@
+// main.swift — System Extension 入口
+//
+// System Extension 是可执行程序(非 appex 的 NSExtensionMain 插件),需显式 main。
+// NEProvider.startSystemExtensionMode() 读 Info.plist 的 NEProviderClasses,
+// 按系统请求实例化并运行 PacketTunnelProvider。dispatchMain() 保持进程常驻。
+
+import Foundation
+import NetworkExtension
+
+autoreleasepool {
+    NEProvider.startSystemExtensionMode()
+}
+dispatchMain()

client/macos/Runner.xcodeproj/project.pbxproj

@@ -30,7 +30,7 @@
 		47B528978FADECB811049EA7 /* Pods_RunnerTests.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 291B2ED6A5127D183A4E505B /* Pods_RunnerTests.framework */; };
 		5C06858DBFCE524FEBB9B432 /* Pods_Runner.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = CCC145126CAA131EED5B5A0E /* Pods_Runner.framework */; };
 		78A318202AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage in Frameworks */ = {isa = PBXBuildFile; productRef = 78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */; };
-		A17B79E92FE50746001ABF28 /* PacketTunnel.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = A17B79DF2FE50745001ABF28 /* PacketTunnel.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
+		A17B79E92FE50746001ABF28 /* PacketTunnel.systemextension in Copy System Extensions */ = {isa = PBXBuildFile; fileRef = A17B79DF2FE50745001ABF28 /* PacketTunnel.systemextension */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		A17B79F62FE52309001ABF28 /* Libbox.xcframework in Frameworks */ = {isa = PBXBuildFile; fileRef = A17B79F52FE52309001ABF28 /* Libbox.xcframework */; };
 		A17B79F72FE52309001ABF28 /* Libbox.xcframework in Embed Frameworks */ = {isa = PBXBuildFile; fileRef = A17B79F52FE52309001ABF28 /* Libbox.xcframework */; settings = {ATTRIBUTES = (CodeSignOnCopy, RemoveHeadersOnCopy, ); }; };
 		A17B79F92FE52315001ABF28 /* NetworkExtension.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = A17B79E02FE50745001ABF28 /* NetworkExtension.framework */; };
@@ -75,15 +75,15 @@
 			name = "Bundle Framework";
 			runOnlyForDeploymentPostprocessing = 0;
 		};
-		A17B79EA2FE50746001ABF28 /* Embed Foundation Extensions */ = {
+		A17B79EA2FE50746001ABF28 /* Copy System Extensions */ = {
 			isa = PBXCopyFilesBuildPhase;
 			buildActionMask = 2147483647;
-			dstPath = "";
-			dstSubfolderSpec = 13;
+			dstPath = "$(SYSTEM_EXTENSIONS_FOLDER_PATH)";
+			dstSubfolderSpec = 16;
 			files = (
-				A17B79E92FE50746001ABF28 /* PacketTunnel.appex in Embed Foundation Extensions */,
+				A17B79E92FE50746001ABF28 /* PacketTunnel.systemextension in Copy System Extensions */,
 			);
-			name = "Embed Foundation Extensions";
+			name = "Copy System Extensions";
 			runOnlyForDeploymentPostprocessing = 0;
 		};
 		A17B79F82FE52309001ABF28 /* Embed Frameworks */ = {
@@ -122,7 +122,7 @@
 		7AFA3C8E1D35360C0083082E /* Release.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = Release.xcconfig; sourceTree = "<group>"; };
 		95E1B7FE7B353A1FC1673682 /* Pods-Runner.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.debug.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.debug.xcconfig"; sourceTree = "<group>"; };
 		9740EEB21CF90195004384FC /* Debug.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = Debug.xcconfig; sourceTree = "<group>"; };
-		A17B79DF2FE50745001ABF28 /* PacketTunnel.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = PacketTunnel.appex; sourceTree = BUILT_PRODUCTS_DIR; };
+		A17B79DF2FE50745001ABF28 /* PacketTunnel.systemextension */ = {isa = PBXFileReference; explicitFileType = "wrapper.system-extension"; includeInIndex = 0; path = PacketTunnel.systemextension; sourceTree = BUILT_PRODUCTS_DIR; };
 		A17B79E02FE50745001ABF28 /* NetworkExtension.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = NetworkExtension.framework; path = System/Library/Frameworks/NetworkExtension.framework; sourceTree = SDKROOT; };
 		A17B79F52FE52309001ABF28 /* Libbox.xcframework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.xcframework; name = Libbox.xcframework; path = Frameworks/Libbox.xcframework; sourceTree = "<group>"; };
 		A17B79FB2FE526F5001ABF28 /* SystemConfiguration.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = SystemConfiguration.framework; path = System/Library/Frameworks/SystemConfiguration.framework; sourceTree = SDKROOT; };
@@ -220,7 +220,7 @@
 			children = (
 				33CC10ED2044A3C60003C045 /* pangolin_vpn.app */,
 				331C80D5294CF71000263BE5 /* RunnerTests.xctest */,
-				A17B79DF2FE50745001ABF28 /* PacketTunnel.appex */,
+				A17B79DF2FE50745001ABF28 /* PacketTunnel.systemextension */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -322,7 +322,7 @@
 				33CC110E2044A8840003C045 /* Bundle Framework */,
 				3399D490228B24CF009A79C7 /* ShellScript */,
 				D3610C37E667F89FD1D27249 /* [CP] Embed Pods Frameworks */,
-				A17B79EA2FE50746001ABF28 /* Embed Foundation Extensions */,
+				A17B79EA2FE50746001ABF28 /* Copy System Extensions */,
 			);
 			buildRules = (
 			);
@@ -358,8 +358,8 @@
 			packageProductDependencies = (
 			);
 			productName = PacketTunnel;
-			productReference = A17B79DF2FE50745001ABF28 /* PacketTunnel.appex */;
-			productType = "com.apple.product-type.app-extension";
+			productReference = A17B79DF2FE50745001ABF28 /* PacketTunnel.systemextension */;
+			productType = "com.apple.product-type.system-extension";
 		};
 /* End PBXNativeTarget section */