Make macOS packaged apps actually work (interactive + assets + entitlements)

[ipfizz]

Building a calculator and running it exposed four real bugs that each broke a packaged macOS app. Fixed all four; bunmaska build now produces a working, signed, interactive .app from one command (verified end to end: window shows, keyboard/mouse work, 9×9 = 81).

The four fixes

1. Window never appeared. The app was activated once at startup, before any window existed. MacOSWindow.show() now activates the app when a window is shown, so a bundled .app comes to the foreground.
2. App was dead to input. The cooperative run-loop ran CFRunLoopRunInMode (which renders) but never dispatched NSApp events, so clicks/keys were never delivered. The drain now runs the standard nextEventMatchingMask: / sendEvent: loop non-blockingly each tick.
3. Built app crashed (exit 133) — missing assets. bun build --compile embeds JS but not runtime-loaded files. bunmaska build now copies the entry's sibling assets (HTML, preload, CSS, images) beside the executable, and the scaffold resolves them via process.execPath when compiled.
4. Signed app crashed (SIGTRAP) — JIT entitlements. codesign --options runtime enabled the Hardened Runtime without the entitlements Bun needs, so the app trapped on its first FFI call. The codesign step now grants allow-jit, allow-unsigned-executable-memory, and disable-library-validation.

Bumps to 0.1.0-alpha.4. Validate green (1596 tests, 0 fail); new unit tests cover the asset predicate and the codesign entitlements.

Note: the run-loop is still a 60Hz cooperative poll. Replacing it with an event-driven CFRunLoop integration is a separate, focused follow-up PR.

🤖 Generated with Claude Code