fix: sign mcp-server helper binary to strip get-task-allow entitlement

Author: datlechin

TablePro.xcodeproj/project.pbxproj

@@ -2391,7 +2391,7 @@
 				CODE_SIGN_STYLE = Automatic;
 				DEVELOPMENT_TEAM = D7HJ5TFYCU;
 				ENABLE_HARDENED_RUNTIME = YES;
-				MACOSX_DEPLOYMENT_TARGET = 26.5;
+				MACOSX_DEPLOYMENT_TARGET = 14.0;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SDKROOT = macosx;
 				SWIFT_APPROACHABLE_CONCURRENCY = YES;
@@ -2406,7 +2406,7 @@
 				CODE_SIGN_STYLE = Automatic;
 				DEVELOPMENT_TEAM = D7HJ5TFYCU;
 				ENABLE_HARDENED_RUNTIME = YES;
-				MACOSX_DEPLOYMENT_TARGET = 26.5;
+				MACOSX_DEPLOYMENT_TARGET = 14.0;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SDKROOT = macosx;
 				SWIFT_APPROACHABLE_CONCURRENCY = YES;

scripts/build-release.sh

@@ -489,6 +489,14 @@ build_for_arch() {
         done
     fi
 
+    # Sign helper executables in Contents/MacOS (e.g., mcp-server)
+    MACOS_DIR="$BUILD_DIR/$OUTPUT_NAME/Contents/MacOS"
+    for helper in "$MACOS_DIR"/*; do
+        [ -f "$helper" ] || continue
+        [ "$(basename "$helper")" = "TablePro" ] && continue
+        codesign -fs "$SIGN_IDENTITY" --force --options runtime --timestamp "$helper"
+    done
+
     # Embed provisioning profile (required for iCloud entitlements)
     PROFILE=$(find ~/Library/MobileDevice/Provisioning\ Profiles -name "*.provisionprofile" -print -quit 2>/dev/null)
     if [ -n "$PROFILE" ]; then