fix(release): restore the macOS icon at 16px and 32px

[sunrioa]

Summary

• Bump electron-builder from 26.15.3 to 26.16.1.
• Move the reproducible-ZIP app-builder-lib patch to the new version and update its LICENSE entry.
• Assert in the macOS packaging verifier that the bundled icon carries 16px and 32px art macOS can draw.

electron-builder 26.15.2 replaced its icon generator, and from then through 26.15.3 the icon it produced stored the 16px and 32px faces as PNG in the legacy icp4/icp5/icp6 slots. macOS does not decode those slots, so Finder list rows, the Trash, Activity Monitor and the mounted installer volume rendered noise while 128px and up stayed correct and hid the breakage. 26.16.0 fixed it upstream by writing those sizes as ic04/ic05 ARGB again.

The icon is produced by a toolset electron-builder downloads at build time, so the version pin does not describe the artifact it yields. verifyPackagedMacApp now reads the bundled icon.icns and rejects PNG in the legacy slots, which is the check that would have caught this before it shipped.

The patch is still needed. 26.16.1 sets -mtm=off and -mta=off for 7z archives upstream, but still not in the zip branch that Windows artifacts take, so only the patch filename and its LICENSE entry change.

Fixes #5528

Verification

• npm run lint
• npm run format:check
• npm run typecheck
• npx knip --workspace apps/desktop
• npx knip --workspace packages/ui
• npm run check:asf-source — 92/92 passed
• npm run check:release — 206/207 passed
• node --test scripts/verify-packaged-app.test.mjs — 25/25 passed
• node --test scripts/verify-packaged-app-icons.test.mjs scripts/generate-app-icons.test.mjs — 7/7 passed
• Ran both icons toolsets by hand on apps/desktop/assets/app-icons/sky.png. Toolset 1.1.0, which 26.15.3 pins, reproduced the shipped icon byte for byte at 159,115 bytes with PNG in the legacy slots. Toolset 1.2.3, which 26.16.1 pins, produced 123,793 bytes with ARGB small sizes that render at 16px.
• Ran the new guard against real artifacts. It rejects the shipped 0.2.0-dev.43 icon, reporting PNG data in the slots macOS does not render, and accepts the same source PNG regenerated with the toolset 26.16.1 pins.
• patch-package --error-on-fail applies the regenerated patch to a pristine app-builder-lib@26.16.1, and the zip branch carries both flags again afterwards.

The single check:release failure is qualify-released-cli-state-root.test.mjs timing out while a full build ran alongside it. It passes 12/12 in isolation and the file never mentions electron-builder or icons.

verify:macos end to end is unrun because it needs the release signing credentials. The icon assertion it gained is covered by the unit tests above and by the artifact run quoted here.

CI is green except test, which failed on two different WorkHub cases across two runs of the same tree: e2e/workhub-layout.spec.ts:26, which also fails on clean main at 87ff279 with the same assertion and line, and the WorkHub native browser presentation smoke under xvfb. None of the packages the lockfile moved are imported anywhere under apps/desktop/src or packages/*/src, and the Electron version is unchanged, so neither case can reach this diff.

To see the defect directly:

iconutil --convert iconset -o /tmp/maka.iconset /Applications/Maka.app/Contents/Resources/icon.icns
open /tmp/maka.iconset/icon_16x16.png

Review focus

The lockfile carries the electron-builder family and its transitive drift. The one direction worth a look is @noble/hashes 2.2.0 to 1.8.0, which is not a downgrade this change chose: app-builder-lib 26.16.1 declares ^1.8.0 where 26.15.3 declared ^2.2.0, and nothing outside app-builder-lib and pkijs depends on it. Every new resolved URL stays on registry.npmjs.org, and the lockfile was regenerated with the pinned npm 11.19.0.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope:

Claude Code assisted with the ICNS slot diagnosis, locating the upstream regression and its fix, the verifier guard and its regression tests, and drafting this description. I reproduced both toolsets against the shipped artifacts and reviewed the final diff, the lockfile, and the test results before submission.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No