fix(macOS): preserve release entitlements when signing (#16125)

* fix(macOS): preserve release entitlements during signing

Signed-off-by: Sidn <3996515+sidnvy@users.noreply.github.com>

* ci(macOS): sign outer app with release entitlements

Signed-off-by: Sidn <3996515+sidnvy@users.noreply.github.com>

---------

Signed-off-by: Sidn <3996515+sidnvy@users.noreply.github.com>

.github/scripts/sign-macos-app.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+app_path=$1
+identity=$2
+entitlements=$3
+
+sign_args=(--force --options runtime --sign "$identity")
+if [[ "$identity" != "-" ]]; then
+  sign_args+=(--timestamp)
+fi
+
+frameworks_path="$app_path/Contents/Frameworks"
+if [[ -d "$frameworks_path" ]]; then
+  while IFS= read -r -d '' code; do
+    if file -b "$code" | grep -q 'Mach-O'; then
+      codesign "${sign_args[@]}" "$code"
+    fi
+  done < <(find "$frameworks_path" -type f -print0)
+
+  while IFS= read -r -d '' framework; do
+    codesign "${sign_args[@]}" "$framework"
+  done < <(find "$frameworks_path" -depth -type d -name '*.framework' -print0)
+fi
+
+service_path="$app_path/Contents/MacOS/service"
+if [[ -f "$service_path" ]]; then
+  codesign "${sign_args[@]}" "$service_path"
+fi
+
+codesign "${sign_args[@]}" --generate-entitlement-der \
+  --entitlements "$entitlements" "$app_path"
+codesign --verify --deep --strict --verbose=2 "$app_path"
+
+actual_entitlements=$(codesign -d --entitlements :- "$app_path" 2>/dev/null)
+audio_input=$(plutil -extract 'com\.apple\.security\.device\.audio-input' raw - \
+  <<<"$actual_entitlements")
+if [[ "$audio_input" != "true" ]]; then
+  echo "Missing com.apple.security.device.audio-input entitlement" >&2
+  exit 1
+fi