Updated both CI macOS staging jobs (arm64 and x86_64) to copy app-installed locale catalogs from $STAGE_PREFIX/share/locale into $STAGE_PREFIX/locale when present, so zoitechat.mo is available to gtk-mac-bundler in the staged tree.
Updated both macOS packaging steps to pass BUNDLE_PREFIX with a trailing slash (.../stage/<arch>/).
Replaced cp -a with rsync -aL when staging enchant so symlinks are dereferenced into the staged tree (avoids Homebrew opt symlink pitfalls).
Adjusted osx/makebundle.sh to preserve a caller-provided trailing slash when writing the XML default prefix (instead of stripping it), matching the CI fix for malformed x86_64locale path concatenation.
Refactor macOS build workflow to support arm64 and x86_64 architectures. Add steps for staging dependencies and packaging unsigned apps for both architectures.
Updated the macOS GitHub Actions workflow to build both architectures (build-macos-arm64 + build-macos-x86_64), then package a universal app by passing both binaries into osx/makebundle.sh.
Documented the universal build invocation in osx/DEBUGGING.md so local builds can reproduce Intel + Apple Silicon compatibility packaging.
Added a Check signing secrets availability step that inspects all required Apple signing/notarization secrets and emits a ready output for downstream gating.
Added an explicit skip message step when secrets are missing, and gated all signing/notarization/artifact-upload steps behind steps.signing_secrets.outputs.ready == 'true' so the workflow remains valid while preserving intended behavior.
Implemented the build-only unsigned macOS phase on macos-latest: installs Meson/Ninja/GTK tooling via Homebrew, configures/builds with Meson, installs for bundling, generates the .app zip via the existing macOS bundle script, and uploads the unsigned artifact with retention (14 days).
Implemented the release-grade gated phase: job is gated to push on master and only runs when required Apple signing/notarization secrets are present; it downloads the unsigned artifact, imports Developer ID cert, codesigns, notarizes with Apple API key credentials, staples the ticket, and uploads a signed artifact with retention (30 days).
