fix: keep boss agent permission grants stable across updates

scripts/build-boss-agent-mac-app.sh

@@ -10,6 +10,7 @@ SOURCE_FILE="$ROOT_DIR/apps/boss-agent-mac/Sources/BossAgentApp.swift"
 BINARY_PATH="$MACOS_DIR/boss-agent"
 ICONSET_DIR="$RESOURCES_DIR/BossAgent.iconset"
 ICON_PATH="$RESOURCES_DIR/BossAgent.icns"
+SIGNING_IDENTITY="${BOSS_AGENT_CODESIGN_IDENTITY:-}"
 
 if ! command -v swiftc >/dev/null 2>&1; then
   echo "swiftc not found. Install Xcode Command Line Tools first." >&2
@@ -21,6 +22,20 @@ if ! command -v iconutil >/dev/null 2>&1; then
   exit 1
 fi
 
+if [[ -z "$SIGNING_IDENTITY" ]] && command -v security >/dev/null 2>&1; then
+  SIGNING_IDENTITY="$(
+    security find-identity -v -p codesigning 2>/dev/null \
+      | awk -F'"' '/"Apple Development:|Developer ID Application:|Mac Developer:|Boss Agent/ { print $2; exit }'
+  )"
+fi
+
+if [[ -z "$SIGNING_IDENTITY" ]]; then
+  SIGNING_IDENTITY="-"
+  echo "boss-agent: no stable code signing identity found; falling back to ad-hoc signing." >&2
+else
+  echo "boss-agent: signing with identity: $SIGNING_IDENTITY" >&2
+fi
+
 rm -rf "$APP_DIR"
 mkdir -p "$MACOS_DIR" "$RESOURCES_DIR"
 
@@ -176,5 +191,5 @@ cat > "$CONTENTS_DIR/Info.plist" <<'PLIST'
 PLIST
 
 plutil -lint "$CONTENTS_DIR/Info.plist" >/dev/null
-codesign --force --deep --sign - "$APP_DIR" >/dev/null
+codesign --force --deep --timestamp=none --sign "$SIGNING_IDENTITY" "$APP_DIR" >/dev/null
 echo "$APP_DIR"