feat(installer): Add universal macOS binary support (Intel + Apple Silicon)

[w-up]

Problem

Official Hermes Desktop DMG (Hermes-Setup.dmg) is arm64-only, preventing Intel Mac users from installing via the GUI installer. The website claims "macOS 12+" support but the product doesn't deliver on Intel machines.

Current behavior:

• Official DMG: Non-fat file: arm64
• Intel Mac users: Cannot run the installer ("This app is not compatible with your Mac")
• Website promise: "macOS 12+" (implies both architectures)

Root cause:
apps/bootstrap-installer (Tauri 2.x) builds for host architecture only by default. Upstream build machines are ARM Macs → arm64-only DMG.

---

Solution

Build a universal macOS binary containing both x86_64 and arm64 in a single DMG — the Apple-recommended distribution model for cross-architecture compatibility.

Changes

1. New GitHub Actions workflow (.github/workflows/build-desktop-installer.yml)

   • Builds universal DMG on installer-v* tags or manual dispatch
   • Verifies binary contains both architectures (lipo -info)
   • Uploads to GitHub Release as draft

2. New README (apps/bootstrap-installer/README.md)

   • Universal build instructions
   • Architecture verification steps
   • Development workflow

3. Raise minimum macOS version (tauri.conf.json: 11.0 → 12.0)

   • Aligns with documented "macOS 12+" support

4. Document Intel support (website/docs/getting-started/installation.md)

   • Explicit note: "universal binary supporting both Intel (x86_64) and Apple Silicon (arm64)"

---

Verification

Local build on Intel Mac (x86_64):

# Universal DMG
npx tauri build --target universal-apple-darwin

# Verify
lipo -info Hermes-Setup
# Output: Architectures in the fat file: ... are: x86_64 arm64

DMG size:

• arm64-only: 7.7 MB
• Universal: ~12 MB (1.5× size, expected for dual-arch binary)

---

Impact

✅ Intel Mac users can now install Hermes Desktop via the official DMG
✅ Single download for all Mac users (no "Which Mac do I have?" confusion)
✅ Aligns product with website promise ("macOS 12+")
✅ Apple-recommended distribution model (Building a Universal macOS Binary)

---

Checklist

• Verified universal binary on Intel Mac (x86_64)
• Added CI workflow for automated builds
• Updated documentation
• Raised minimumSystemVersion to match documented support (12.0)
• Tested on Apple Silicon Mac (CI will verify, or maintainers can test)
• Manual trigger workflow to generate first universal DMG

---

Related

• If there's an open issue for Intel Mac installer support, this closes it
• Alternative to shipping two separate DMGs (x64 + arm64)

[teknium1]

Thanks for tackling a real Intel-Mac distribution request; the linked reports #42928 and #60054 confirm that users need a supported official path.

Problems

• Current main still declares Intel macOS unsupported at website/docs/getting-started/platform-support.md:46; this needs a maintainer support-policy decision before the docs can claim universal support.
• The workflow only triggers on installer-v* (.github/workflows/build-desktop-installer.yml:17-19), while normal releases use CalVer v20* tags (.github/workflows/upload_to_pypi.yml:3-9), so ordinary releases would not publish this artifact.
• External actions are floating tags (build-desktop-installer.yml:28,31,37,60,68), contrary to the SHA-pinning policy in AGENTS.md:569.
• upload_release can publish from a manually dispatched branch because line 67 does not enforce a tag.

Suggested changes

• Confirm and document the Intel support decision in the platform matrix.
• Integrate this build into the actual CalVer release path, enforce tag-only publication, and SHA-pin every action.
• Retain macOS 11 support unless a separate compatibility decision approves tauri.conf.json's 12.0 minimum.

Automated hermes-sweeper review.

[teknium1]

This trigger is outside the current product release convention: .github/workflows/upload_to_pypi.yml:3-9 publishes CalVer v20* tags. Please wire this into the authoritative release path (or establish the separate installer-release lifecycle), otherwise ordinary releases will never produce the universal installer.

[teknium1]

Repository policy requires every third-party GitHub Action to use an immutable full commit SHA plus a version comment (AGENTS.md:569). Please pin this and the other new external actions in this workflow rather than using mutable tags.

[teknium1]

The manual upload_release path can satisfy this condition from an arbitrary branch, despite the input saying a tag is required. Enforce github.ref_type == 'tag' and bind publication to that tag before creating or uploading a release.

[teknium1]

This drops macOS 11 compatibility for existing Apple-Silicon users. Current main does not document a macOS 12 minimum; please keep 11.0 unless a separately approved platform-support decision changes the compatibility contract.

[RobbieMcKinstry]

@w-up are you still planning to take this across the finish line, or are you parking it here? I think the ball's in your court since @teknium1 completed a code review pass with modification requests.

[w-up]

Thanks for the follow-up. I am parking this implementation and closing the PR in favor of #37762, which is the narrower and more actively maintained universal-installer path.

#37762 now has SHA-pinned actions, explicit lipo checks for both x86_64 and arm64, the corrected Hermes.app bundle path, and real Intel Mac build/runtime evidence. This PR would still need release-trigger integration, tag-only publication guards, pinned actions, and reconciliation of the macOS deployment target.

More importantly, official Intel macOS support is still listed as unsupported in the platform matrix and remains a maintainer policy decision (needs-decision on #37762), so maintaining a second overlapping workflow here would not resolve the actual merge blocker.

Closing as superseded by #37762. Thank you @RobbieMcKinstry for checking in.