Add macOS notarization entitlements + iOS mobile guards

- Add entitlements.plist for Developer ID hardened runtime (JIT,
  unsigned memory, library validation, network client)
- Reference entitlements in tauri.conf.json bundle.macOS
- Guard get_install_type() with early mobile return (avoids
  std::process::Command in iOS binary)
- Add cfg(mobile) no-op branch to xdg_open()

src-tauri/entitlements.plist

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- Hardened runtime entitlements for Developer ID distribution (outside Mac App Store).
+         Required for notarization. These do NOT enable App Sandbox.
+         Without these, the WebKit webview and bundled Rust libraries get killed by the
+         hardened runtime's library validation. -->
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <!-- Network access for auto-updater, AI features, WebDAV sync, image proxy -->
+    <key>com.apple.security.network.client</key>
+    <true/>
+</dict>
+</plist>

src-tauri/src/commands.rs

@@ -1486,6 +1486,10 @@ fn xdg_open(arg: &str) -> Result<(), String> {
             .spawn()
             .map_err(|e| format!("Failed to open {}: {}", arg, e))?;
     }
+    #[cfg(mobile)]
+    {
+        let _ = arg;
+    }
     Ok(())
 }
 
@@ -2061,6 +2065,14 @@ pub fn get_install_type() -> String {
             return forced.to_string();
         }
     }
+
+    // On mobile (iOS/Android) the concept of install type is irrelevant and the
+    // Linux detection below would attempt std::process::Command which is forbidden
+    // in the iOS sandbox. Return early.
+    if cfg!(mobile) {
+        return "mobile".to_string();
+    }
+
     if cfg!(target_os = "macos") {
         "macos".to_string()
     } else if cfg!(target_os = "windows") {

src-tauri/tauri.conf.json

@@ -55,6 +55,9 @@
       "appimage": {
         "bundleMediaFramework": false
       }
+    },
+    "macOS": {
+      "entitlements": "entitlements.plist"
     }
   }
 }