build audiotee from the third_party/audiotee submodule, not a sibling dir

The initial commit's embed-binaries.sh still had the pre-submodule logic
(../audiotee sibling checkout) even though third_party/audiotee was
already added and referenced in CLAUDE.md — the edit to actually switch
the script over got made but never re-staged before the first commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -112,9 +112,22 @@ now), re-verify rather than assume this still holds.
 Implemented: `scripts/embed-binaries.sh`, invoked by a "Run Script" build phase named "Embed
 audiotee, transcriptor-ai, qwen_asr" (last phase on the `transcriptor` target, after
 Resources). It:
-- `../audiotee` — runs `scripts/build-signed.sh` there, then copies the resulting
-  `~/bin/audiotee` in. Doesn't reimplement audiotee's signing logic, just invokes it.
-- `../transcriptor-ai` — runs `scripts/build-dist.sh` there (builds both `transcriptor-ai`
+- `third_party/audiotee` — a **git submodule** (2026-08-09), pinned to a commit on our own
+  Gitea fork (`ssh://git@gitea.sttlab.eu:2222/stt/audiotee.git`, migrated there from
+  `github.com/makeusabrew/audiotee` since we don't have push access upstream — that GitHub
+  remote is now `upstream` in the audiotee repo, `origin` is the Gitea fork). Was a sibling
+  directory (`../audiotee`) before this — converted for the same reason `transcriptor-ai`
+  already vendors `qwen-asr` as a submodule: this script shouldn't depend on a checkout
+  existing at some assumed sibling path on whatever machine builds this. The script runs
+  `git submodule update --init --recursive third_party/audiotee`, then
+  `third_party/audiotee/scripts/build-signed.sh`, then copies the resulting `~/bin/audiotee`
+  in (`build-signed.sh` always installs there regardless of where its own source checkout
+  lives, so nothing else needed to change). Verified end to end after the conversion: ran the
+  script standalone, confirmed (via `codesign -dvvv` and `md5`) the embedded binary was
+  freshly built from the submodule checkout and correctly signed, not a stale leftover.
+- `../transcriptor-ai` — still a **sibling directory**, not a submodule (not converted —
+  wasn't asked for, and the audiotee fragility this session's change addressed doesn't apply
+  to it the same way yet). Runs `scripts/build-dist.sh` there (builds both `transcriptor-ai`
   and `qwen_asr`, the latter from a pinned git submodule, `third_party/qwen-asr`, inside that
   repo, into `dist/`), then copies `dist/*` in. This repo still doesn't need to know about
   qwen-asr directly — that stays `transcriptor-ai`'s dependency to manage.

scripts/embed-binaries.sh

@@ -1,8 +1,17 @@
 #!/bin/bash
 # Xcode "Run Script" build phase: builds audiotee, transcriptor-ai, and
-# qwen_asr from the sibling repos and embeds them in this app's bundle —
-# the "one-click install" requirement (see CLAUDE.md, "Goal"). Only the AI
-# model is left to fetch at runtime; everything else is baked in here.
+# qwen_asr and embeds them in this app's bundle — the "one-click install"
+# requirement (see CLAUDE.md, "Goal"). Only the AI model is left to fetch
+# at runtime; everything else is baked in here.
+#
+# audiotee is a git submodule (third_party/audiotee, pinned to a commit on
+# our own Gitea fork — see CLAUDE.md) — same pattern transcriptor-ai
+# already uses for qwen-asr, and for the same reason: this script shouldn't
+# depend on a sibling checkout existing at some assumed path on whatever
+# machine builds this. transcriptor-ai itself is still a sibling-directory
+# dependency (`../transcriptor-ai`) — not converted to a submodule, that
+# wasn't asked for and isn't needed to fix the audiotee fragility this was
+# about.
 #
 # Expects Xcode's build environment variables (SRCROOT, BUILT_PRODUCTS_DIR,
 # UNLOCALIZED_RESOURCES_FOLDER_PATH). Run manually for debugging via:
@@ -19,9 +28,12 @@ export PATH="/opt/homebrew/bin:/usr/local/bin:$PATH"
 
 SRCROOT="${SRCROOT:?SRCROOT must be set (run via Xcode, or set it manually — see header comment)}"
 REPO_ROOT="$(cd "$SRCROOT" && pwd)"
-AUDIOTEE_REPO="$(cd "$REPO_ROOT/../audiotee" && pwd)"
+AUDIOTEE_REPO="$REPO_ROOT/third_party/audiotee"
 TRANSCRIPTOR_AI_REPO="$(cd "$REPO_ROOT/../transcriptor-ai" && pwd)"
 
+echo "Ensuring audiotee submodule is present (pinned commit)..."
+git -C "$REPO_ROOT" submodule update --init --recursive third_party/audiotee
+
 echo "Building audiotee..."
 "$AUDIOTEE_REPO/scripts/build-signed.sh"