Bundle signed voice resources in macOS releases (#43983)

## What changed

- Build, sign, and notarize `codex-voice-host` and its native runtime for Apple Silicon and Intel macOS release packages, granting the helper audio-input access.
- Include voice resources in primary package archives and DMGs, with a root-level `codex` symlink to `bin/codex` so the runtime can be located.
- Seal runtime receipts with post-signing hashes, require matching release versions and source builds, and bundle dependency notices, licenses, and source metadata.
- Keep voice resources out of Python wheels to preserve their older macOS compatibility; the native voice build targets macOS 14.

## Testing

Add packaging tests for alpha, beta, and stable versions, signed-byte preservation, license hashes, receipt validation, tamper detection, and exclusion of unlisted files. Extend release verification to check voice architectures, signatures, build identity, package hashes, and DMG contents.

GitOrigin-RevId: 9f9415a8b2532d655a9a8740bcdf64066ddb7472

.github/scripts/build-codex-package-archive.sh

@@ -15,6 +15,7 @@ Usage: build-codex-package-archive.sh \
   [--zsh-manifest <path>] \
   [--codex-command-runner-bin <path>] \
   [--codex-windows-sandbox-setup-bin <path>] \
+  [--voice-signed-dir <path> --release-version <release-version>] \
   [--target-suffixed-entrypoint]
 EOF
 }
@@ -29,6 +30,8 @@ bwrap_bin_provided="false"
 code_mode_host_bin_provided="false"
 command_runner_bin_provided="false"
 sandbox_setup_bin_provided="false"
+voice_signed_dir=""
+release_version=""
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -90,6 +93,14 @@ while [[ $# -gt 0 ]]; do
       target_suffixed_entrypoint="true"
       shift
       ;;
+    --voice-signed-dir)
+      voice_signed_dir="${2:?--voice-signed-dir requires a value}"
+      shift 2
+      ;;
+    --release-version)
+      release_version="${2:?--release-version requires a value}"
+      shift 2
+      ;;
     -h|--help)
       usage
       exit 0
@@ -106,6 +117,10 @@ if [[ -z "$target" || -z "$bundle" || -z "$entrypoint_dir" || -z "$archive_dir"
   usage >&2
   exit 1
 fi
+if [[ ( -n "$voice_signed_dir" || -n "$release_version" ) && ( -z "$voice_signed_dir" || -z "$release_version" || "$bundle" != "primary" || "$target" != *-apple-darwin ) ]]; then
+  echo "Signed voice resources require a primary macOS release package version" >&2
+  exit 1
+fi
 
 case "$bundle" in
   primary)
@@ -188,12 +203,36 @@ python_args=(
   --entrypoint-bin "${entrypoint_dir%/}/${entrypoint_name}${exe_suffix}"
   --cargo-profile release
   --package-dir "$package_dir"
-  --archive-output "$gzip_archive_path"
-  --archive-output "$zstd_archive_path"
 )
+if [[ -z "$voice_signed_dir" ]]; then
+  python_args+=(--archive-output "$gzip_archive_path" --archive-output "$zstd_archive_path")
+fi
 if ((${#resource_args[@]} > 0)); then
   python_args+=("${resource_args[@]}")
 fi
 python_args+=(--force)
 
 "$python_bin" "${python_args[@]}"
+
+if [[ -n "$voice_signed_dir" ]]; then
+  voice_package="${RUNNER_TEMP:-/tmp}/${archive_stem}-voice-${target}"
+  rm -rf "$voice_package"
+  "$python_bin" "${repo_root}/third_party/voice/assemble_package.py" \
+    --package "$package_dir" \
+    --helper "${voice_signed_dir%/}/codex-voice-host" \
+    --runtime "${voice_signed_dir%/}/runtime" \
+    --voice-target "$target" \
+    --build-commit "$(git -C "$repo_root" rev-parse HEAD)" \
+    --release-version "$release_version" \
+    --output "$voice_package"
+  PYTHONPATH="${repo_root}/public/scripts" "$python_bin" - \
+    "$voice_package" "$gzip_archive_path" "$zstd_archive_path" <<'PY'
+import sys
+from pathlib import Path
+from codex_package.archive import write_archive
+
+package = Path(sys.argv[1])
+for archive in sys.argv[2:]:
+    write_archive(package, Path(archive), force=True)
+PY
+fi

.github/scripts/macos-signing/codex-voice-host.entitlements.plist

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.device.audio-input</key>
+	<true/>
+</dict>
+</plist>