Add macOS notarization entitlements + iOS mobile guards

- Add entitlements.plist for Developer ID hardened runtime (JIT,
  unsigned memory, library validation, network client)
- Reference entitlements in tauri.conf.json bundle.macOS
- Guard get_install_type() with early mobile return (avoids
  std::process::Command in iOS binary)
- Add cfg(mobile) no-op branch to xdg_open()

src-tauri/src/commands.rs

@@ -1486,6 +1486,10 @@ fn xdg_open(arg: &str) -> Result<(), String> {
             .spawn()
             .map_err(|e| format!("Failed to open {}: {}", arg, e))?;
     }
+    #[cfg(mobile)]
+    {
+        let _ = arg;
+    }
     Ok(())
 }
 
@@ -2061,6 +2065,14 @@ pub fn get_install_type() -> String {
             return forced.to_string();
         }
     }
+
+    // On mobile (iOS/Android) the concept of install type is irrelevant and the
+    // Linux detection below would attempt std::process::Command which is forbidden
+    // in the iOS sandbox. Return early.
+    if cfg!(mobile) {
+        return "mobile".to_string();
+    }
+
     if cfg!(target_os = "macos") {
         "macos".to_string()
     } else if cfg!(target_os = "windows") {