Gatekeeper reported the Bare server binary as damaged because it only
had a linker ad-hoc stamp after embed. Seal darwin server binaries with
the same sign-macos path used for Electron apps (codesign / rcodesign).
Rolling release runners stall or fail fetching apple-codesign releases.
Ship linux-x64 and linux-arm64 binaries under tools/rcodesign/ and install
from the checkout so the ad-hoc macOS signing step is offline and fast.
Raven Scott