fix(cli): validate macOS sandbox dylib during setup

Author: tonyfettes

cli/cef/cef_platform.mbt

@@ -236,6 +236,9 @@ fn installed_cef_relative_files(platform : ProtonPlatform) -> Array[String] {
     let libraries_root = "Release/Chromium Embedded Framework.framework/Libraries"
     files.push(@fsutil.path_join(libraries_root, "libEGL.dylib"))
     files.push(@fsutil.path_join(libraries_root, "libGLESv2.dylib"))
+    // Packaging signs every nested CEF Mach-O before sealing the framework.
+    // Reject incomplete archives during setup instead of failing at signing.
+    files.push(@fsutil.path_join(libraries_root, "libcef_sandbox.dylib"))
     files.push(@fsutil.path_join(libraries_root, "libvk_swiftshader.dylib"))
   }
   files
@@ -281,6 +284,7 @@ fn runtime_required_relative_files(platform : ProtonPlatform) -> Array[String] {
     [
       "bin/cef_process", "lib/libproton.dylib", "bin/libEGL.dylib", "bin/libGLESv2.dylib",
       "bin/libvk_swiftshader.dylib", "Frameworks/Chromium Embedded Framework.framework/Chromium Embedded Framework",
+      "Frameworks/Chromium Embedded Framework.framework/Libraries/libcef_sandbox.dylib",
       "Resources/icudtl.dat",
     ]
   } else {

cli/cef/cef_platform_wbtest.mbt

@@ -1,10 +1,16 @@
 ///|
-test "darwin arm64 platform has proton and runtime artifact lists" {
+test "darwin arm64 platform has complete CEF and Proton runtime artifact lists" {
   let platform = darwin_arm64_platform()
   let prebuilt = proton_prebuilt_relative_files(platform)
   assert_true(prebuilt.contains("bin/cef_process"))
   assert_true(prebuilt.contains("lib/libproton.dylib"))
   assert_true(prebuilt.contains("include/proton_native.h"))
+  let cef = installed_cef_relative_files(platform)
+  assert_true(
+    cef.contains(
+      "Release/Chromium Embedded Framework.framework/Libraries/libcef_sandbox.dylib",
+    ),
+  )
   let runtime = runtime_required_relative_files(platform)
   assert_true(runtime.contains("bin/cef_process"))
   assert_true(runtime.contains("lib/libproton.dylib"))
@@ -13,6 +19,11 @@ test "darwin arm64 platform has proton and runtime artifact lists" {
       "Frameworks/Chromium Embedded Framework.framework/Chromium Embedded Framework",
     ),
   )
+  assert_true(
+    runtime.contains(
+      "Frameworks/Chromium Embedded Framework.framework/Libraries/libcef_sandbox.dylib",
+    ),
+  )
   assert_true(runtime.contains("Resources/icudtl.dat"))
 }