fix(macos): sign nested mpv with bundle identifier for Now Playing attribution

mediaremoted resolves the Now Playing client from the registering process's
code-signing identifier, not its bundle. codesign derives the identifier of
a plist-less executable from its basename, so the bundled mpv was stamped
'mpv' regardless of PodTui.app — the audio center kept showing a blank
placeholder. Signing mpv last with --identifier com.mikefreno.podtui (after
the bundle deep-seal, which would otherwise re-derive the basename) makes
the session register as PodTui: icon + name. Identity overridable via
PODTUI_CODESIGN_IDENTITY for Developer ID release builds.

build.ts

@@ -200,12 +200,15 @@ if (COMPILE) {
 		);
 
 		// Ad-hoc sign so the bundle launches cleanly on fresh machines.
+		// Identity overridable via PODTUI_CODESIGN_IDENTITY (e.g. a Developer
+		// ID cert for release builds); default ad-hoc.
+		const signIdentity = process.env.PODTUI_CODESIGN_IDENTITY || "-";
 		const sign = Bun.spawnSync([
 			"codesign",
 			"--force",
 			"--deep",
 			"-s",
-			"-",
+			signIdentity,
 			appRoot,
 		]);
 		if (sign.exitCode !== 0) {
@@ -213,6 +216,29 @@ if (COMPILE) {
 				`Warning: codesign failed (${sign.stderr.toString().trim()}) — app bundle unsigned`,
 			);
 		}
+
+		// Sign the nested mpv LAST with our bundle identifier. mediaremoted
+		// resolves the Now Playing client from the registering process's
+		// code-signing identifier — without an explicit --identifier codesign
+		// stamps "mpv" (its basename) and the audio center shows a blank
+		// placeholder. Must run after the bundle sign above (a later bundle
+		// re-seal would re-derive the basename identifier).
+		const signMpv = Bun.spawnSync([
+			"codesign",
+			"--force",
+			"-s",
+			signIdentity,
+			"--identifier",
+			"com.mikefreno.podtui",
+			join(macosDir, "mpv"),
+		]);
+		if (signMpv.exitCode !== 0) {
+			console.warn(
+				`Warning: nested mpv signing failed (${signMpv.stderr
+					.toString()
+					.trim()}) — Now Playing attribution won't work`,
+			);
+		}
 		console.log(`App bundle: ${appRoot}`);
 	}