add microphone capture and stable code signing for TCC persistence

Adds --capture-mic/--mic-output for a second, independently-captured audio
track (mic vs system, written to separate outputs to avoid interleaving
corruption). Embeds Info.plist at link time so the binary carries a stable
CFBundleIdentifier and the usage-description keys TCC requires, and adds
scripts/build-signed.sh + scripts/create-signing-identity.sh so a rebuilt
binary keeps the same signing identity instead of losing granted
permissions on every rebuild.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/create-signing-identity.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+# One-time setup: creates a self-signed code-signing certificate and trusts
+# it for the "codeSign" policy, entirely via CLI (no Keychain Access GUI).
+# This is what scripts/build-signed.sh needs to sign audiotee with a stable
+# identity — see CONTEXT.md §6.2 for why that matters.
+#
+# This script modifies your login keychain's trust settings. Read it before
+# running it. macOS will likely prompt for your login password during the
+# `security import` / `security add-trusted-cert` steps — that's expected,
+# it's the OS asking permission to change keychain ACLs/trust, not this
+# script asking for your password directly.
+#
+# Usage:
+#   scripts/create-signing-identity.sh [certificate-name]
+#   (default name: audiotee-dev)
+
+set -euo pipefail
+
+CERT_NAME="${1:-audiotee-dev}"
+DAYS=3650
+KEYCHAIN="$HOME/Library/Keychains/login.keychain-db"
+WORKDIR="$(mktemp -d)"
+trap 'rm -rf "$WORKDIR"' EXIT
+
+EXISTING="$(security find-identity -v -p codesigning | grep -c "\"$CERT_NAME\"" || true)"
+if [[ "$EXISTING" -gt 0 ]]; then
+  echo "A code-signing identity named \"$CERT_NAME\" already exists. Nothing to do."
+  security find-identity -v -p codesigning
+  exit 0
+fi
+
+echo "Generating a self-signed code-signing certificate: $CERT_NAME"
+openssl req -x509 -newkey rsa:2048 \
+  -keyout "$WORKDIR/key.pem" -out "$WORKDIR/cert.pem" \
+  -days "$DAYS" -nodes -subj "/CN=$CERT_NAME" \
+  -addext "extendedKeyUsage=critical,codeSigning" \
+  -addext "basicConstraints=critical,CA:false" \
+  -addext "keyUsage=critical,digitalSignature"
+
+# -legacy: OpenSSL 3.x defaults to AES-256/SHA-256 for PKCS12, which macOS's
+# Security framework can't read (fails with a misleading "wrong password?").
+# It needs the older RC2/3DES-based encoding this flag produces.
+openssl pkcs12 -export -out "$WORKDIR/cert.p12" \
+  -inkey "$WORKDIR/key.pem" -in "$WORKDIR/cert.pem" -passout pass:temporary \
+  -legacy
+
+echo "Importing into your login keychain (may prompt for your login password)..."
+security import "$WORKDIR/cert.p12" -k "$KEYCHAIN" -P temporary \
+  -T /usr/bin/codesign -T /usr/bin/security
+
+echo "Trusting it for code signing only, not as a general root CA" \
+  "(may prompt for your login password)..."
+security add-trusted-cert -r trustRoot -p codeSign -k "$KEYCHAIN" "$WORKDIR/cert.pem"
+
+echo ""
+echo "Done. Verifying the identity is now usable by codesign:"
+security find-identity -v -p codesigning
+
+echo ""
+echo "Next: scripts/build-signed.sh (it auto-detects this identity)."