Claude Code helper bundle ships without an app icon — blank grey row in System Settings → Privacy & Security

## Summary

The `claude.app` helper bundle that Claude Code runs from contains no icon
resource, so every TCC permission entry it creates (Accessibility, Screen
Recording, …) renders as a generic grey placeholder in System Settings →
Privacy & Security. Claude Desktop, listed right next to it, shows its icon
normally.

## Environment

- macOS 26.6.2 (25G83), Apple silicon (arm64)
- Claude Desktop 1.34493.1
- Bundled Claude Code 2.1.237 — `~/Library/Application Support/Claude/claude-code/2.1.237/claude.app`
- Standalone CLI 2.1.220 (unaffected — it is not a bundle)

## Steps to reproduce

1. Grant Claude Code a TCC permission, e.g. Screen Recording or Accessibility.
2. Open System Settings → Privacy & Security → Screen Recording.
3. The "Claude Code" row shows a blank grey placeholder icon. The Claude
Desktop row shows the proper app icon.

## Cause

The helper bundle has no `Contents/Resources` directory at all and no
`CFBundleIconFile` / `CFBundleIconName` key, so macOS falls back to the
generic executable placeholder:

```
$ plutil -p ".../claude-code/2.1.237/claude.app/Contents/Info.plist" \
| grep -iE "icon|CFBundleName|CFBundleIdentifier"
"CFBundleIdentifier" => "com.anthropic.claude-code"
"CFBundleName" => "Claude Code"

$ ls ".../claude-code/2.1.237/claude.app/Contents"
CodeResources
Info.plist
MacOS
_CodeSignature
```

For contrast, `/Applications/Claude.app` (`com.anthropic.claudefordesktop`)
sets `CFBundleIconFile => electron.icns` and displays correctly.

## Impact

Cosmetic, but it lands in exactly the place where a user decides whether to
hand over screen recording, accessibility or full disk access. An unnamed grey
row is harder to recognise and reads as less trustworthy than every other
entry in that list.

## Why users cannot work around it locally

Dropping an `.icns` into the bundle breaks the resource seal — verified on a
copy, not on the installed bundle:

```
$ codesign --verify --verbose=2 /tmp/nesttest/claude.app
/tmp/nesttest/claude.app: a sealed resource is missing or invalid
file added: /private/tmp/nesttest/claude.app/Contents/Resources/AppIcon.icns
```

The bundle is signed (Team ID Q6L2SF6YDW) with hardened runtime, so an invalid
seal risks the app being refused launch, and re-signing ad-hoc would change the
code identity and reset TCC permissions the user has already granted. The
version-pinned path (`.../2.1.237/...`) also means any local edit is discarded
on the next update.

## Suggested fix

Ship an `.icns` in `Contents/Resources` and set `CFBundleIconFile` in the
helper bundle's `Info.plist` before signing.

Start by locating the packaging entry point that produces the version-pinned claude.app at ~/Library/Application Support/Claude/claude-code/2.1.237/claude.app, then inspect its Contents/Info.plist and Contents/Resources. Done means the shipped helper bundle contains an icon resource, references it through CFBundleIconFile or CFBundleIconName, and remains validly signed so its TCC entries display the icon.

Written by the indexing model from the issue text.