fix: check release architectures with native lipo syntax

.github/workflows/ci.yml

@@ -45,6 +45,8 @@ jobs:
         run: shellcheck -x scripts/*.sh && actionlint .github/workflows/*.yml
       - name: Swift test + coverage
         run: scripts/check-coverage.sh
+      - name: Test native release architecture gate
+        run: scripts/test-release-architecture.sh
       - name: Test CI release source validation
         run: node --test scripts/release-source.test.cjs
       - name: Credential-free release harness

.github/workflows/release.yml

@@ -130,7 +130,7 @@ jobs:
         run: |
           set -euo pipefail
           chmod +x payload/remindctl
-          lipo -verify_arch arm64 x86_64 payload/remindctl
+          for architecture in arm64 x86_64; do lipo payload/remindctl -verify_arch "$architecture"; done
           codesign --force --timestamp --options runtime \
             --identifier com.steipete.remindctl \
             --requirements '=designated => identifier "com.steipete.remindctl" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "FWJYW4S8P8"' \

scripts/test-release-architecture.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Exercise the workflow's real lipo argument order on universal and thin Mach-O objects.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+printf 'int release_fixture;\n' > "$work/fixture.c"
+for architecture in arm64 x86_64; do
+  clang -target "$architecture-apple-macos14" -c "$work/fixture.c" -o "$work/$architecture.o"
+done
+lipo -create "$work/arm64.o" "$work/x86_64.o" -output "$work/universal.o"
+gate="$(sed -n '/^[ ]*for architecture in arm64 x86_64; do lipo /p' "$ROOT/.github/workflows/release.yml")"
+[[ -n "$gate" ]] || { echo 'Workflow architecture gate is missing' >&2; exit 1; }
+verify_fixture() {
+  local command
+  command=${gate//payload\/remindctl/"$1"}
+  bash -euc "$command"
+}
+verify_fixture "$work/universal.o"
+if verify_fixture "$work/arm64.o" 2>/dev/null; then
+  echo 'Architecture gate accepted a thin Mach-O' >&2
+  exit 1
+fi
+echo 'Workflow architecture gate accepts universal and rejects thin Mach-O'