fix(release): bump electron-builder to 26.16.1 for macOS keychain fix

[MTVaught]

Problem

macOS release builds have failed since Sep 8 during code signing:

security: SecKeychainUnlock: The user name or passphrase you entered is not correct.
Command failed: /usr/bin/security set-key-partition-list -S apple-tool:,apple: -s -k *** <temp>.keychain

electron-builder 26.15.6 passes the .p12 import password to set-key-partition-list instead of the temporary keychain's own password. Older runner images tolerated that. The macos-latest image moved from 20260728 (macOS 25.5.0) to 20260831 (macOS 25.6.0) between the last good release on Sep 3 and the first failure on Sep 8, with identical build code and the same electron-builder pin. Tracked upstream as electron-userland/electron-builder#10066, fixed in pingdotgg#10101 and backported to the v26 line in #10172.

Fix

Pin electron-builder to 26.16.1 and refresh the lockfile. app-builder-lib, dmg-builder, and electron-builder-squirrel-windows all move to 26.16.1. I verified the installed app-builder-lib/out/codeSign/macCodeSign.js now passes keychainPassword to set-key-partition-list. No pnpm override or patch references the old version.

Verification

scripts/sign-macos.test.ts and scripts/build-desktop-artifact.test.ts pass (58 tests). The real proof is the Release run triggered by merging this.

Made with Claude Fable 5.1 in Claude Code.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.2 KiB	13.2 KiB	−85 B (−0.6%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−86 B (−1.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	54.7 KiB	−822 B (−1.4%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	+26 B (+0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+27 B (+0.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	56.4 KiB	+44 B (+0.1%)	66.4 KiB	✅
Claude	Live turn messages	8	9	+1 (+12.5%)	21	✅

Baseline: a8040fb · PR result: 500b1b8 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.