[Bug] macOS arm64 v0.5.2 official DMG and updater app fail code-signature verification

## Summary

On macOS 26.5.1 (Apple Silicon / arm64), the app contained in both official Buzz Desktop v0.5.2 macOS artifacts fails strict Apple code-signature verification:

- the versioned `Buzz_0.5.2_aarch64.dmg`; and
- the arm64 `Buzz.app.tar.gz` served by the rolling updater release.

Fresh downloads matched the SHA-256 digests published by GitHub. The app contents from the DMG and updater archive were byte-for-byte identical. An installed v0.5.2 app was also byte-for-byte identical to those official artifacts. An earlier official Buzz Desktop v0.4.26 artifact passed `codesign` and Gatekeeper verification on the same Mac.

No application launch or account setup is required to reproduce this.

## Official artifacts tested

### Versioned Apple Silicon DMG

- Release: https://github.com/block/buzz/releases/tag/v0.5.2
- Asset: `Buzz_0.5.2_aarch64.dmg`
- Size: `88,323,416` bytes
- SHA-256: `7ae12ecaec240ea75eac0085f8d190797f6d07112bf9bded9b3e942c4bacf33c`
- The disk image's internal checksum verification also passed.

### Rolling updater archive

- Release: https://github.com/block/buzz/releases/tag/buzz-desktop-latest
- Asset: `Buzz.app.tar.gz`
- Size: `80,954,257` bytes
- SHA-256: `b312822806868639c4b09cba9d2b03481ee8530409dc98462b0e02a85d1e7253`
- The extracted executable is a thin arm64 Mach-O.

`diff -rq` reported no differences between the app inside the DMG, the app inside the updater archive, and the installed app.

## Reproduction

After mounting the hash-verified DMG read-only or extracting the hash-verified updater archive, run:

```sh
codesign --verify --deep --strict --verbose=4 "/path/to/Buzz.app"
spctl --assess --type execute --verbose=4 "/path/to/Buzz.app"
```

`codesign` exits 1:

```text
Buzz.app: invalid signature (code or signature have been modified)
In architecture: arm64
```

Gatekeeper exits 1:

```text
Buzz.app: internal error in Code Signing subsystem
```

The failure is not limited to the top-level bundle seal. Each individual Mach-O in `Contents/MacOS` returns the same `invalid signature` result:

- `buzz`
- `buzz-acp`
- `buzz-agent`
- `buzz-desktop`
- `buzz-dev-mcp`
- `git-credential-nostr`

The embedded metadata still reports `TeamIdentifier=EYF346PHUG`, hardened runtime, and a stapled notarization ticket.

## Expected behavior

The official versioned macOS DMG and updater archive should pass both strict `codesign` verification and Gatekeeper assessment after their published digests have been verified.

## Additional public release evidence

The official v0.5.2 release run reports the arm64 `Codesign and Notarize` and `Verify code signature` steps as successful:

https://github.com/block/buzz/actions/runs/30494362798

This differs from #2690: the updater payload tested here is arm64, and the versioned arm64 DMG independently contains the same signature-invalid app.

Could the maintainers reproduce `codesign --verify --deep --strict` and `spctl --assess --type execute` against the currently published arm64 assets on a clean macOS host?

Start by reproducing the failure with codesign --verify --deep --strict and spctl --assess against the published arm64 DMG and updater archive. Then inspect the v0.5.2 release run's “Codesign and Notarize” and “Verify code signature” steps. Done means both official arm64 artifacts pass strict signature verification and Gatekeeper assessment.

Written by the indexing model from the issue text.