desktop: the payload fixed — 7.4GB→144MB, dev keys out, boot-smoke gate

- desktop:dist cleans dist/ + .next/standalone before next build: the
  trace sweep was shipping the PREVIOUS build's DMG inside every new one
  (standalone/dist = 8.0GB inside the app; measured 7.4GB DMG → 144MB).
- the same sweep shipped the repo-root auth.json (dev BYOK keys,
  byte-identical) in every DMG ever built — excluded in the trace and
  REFUSED by a new build-server.mjs guard (.env* belt-and-braces).
- WARNING (next.config.ts): dir-style trace excludes (dist/** etc.,
  "./"-anchored or not) strip server-external packages to bare
  package.jsons — pi-ai/pi-agent-core lost their dist/, the packaged
  server 500'd on ERR_MODULE_NOT_FOUND. Only the three verified-safe
  entries stay.
- new scripts/smoke-server.mjs gates desktop:dist between payload
  curation and packaging: boots the standalone exactly as the Electron
  shell does (temp LH_DATA_DIR, empty auth) and requires 200s on / +
  graph/models/settings. Caught both defects above on its first day.
- entitlements: allow-unsigned-executable-memory dropped (2019-era
  relic per current electron-builder docs; weakens hardened runtime).
- pi-ai + pi-agent-core pinned exact 1.0.2 — persisted chat records
  carry their wire shapes; post-release a bump is a migration event.

Gates: typecheck, lint, 1459/1459 tests, full desktop:dist + smoke PASS.

build/entitlements.mac.plist

@@ -3,16 +3,18 @@
 <plist version="1.0">
 <dict>
 	<!-- Hardened-runtime entitlements (applied once the app is signed).
-	     Laid now (2026-09-17) so the STT milestone doesn't rebuild packaging:
-	     - allow-jit / allow-unsigned-executable-memory: Electron's V8 needs
-	       both under hardened runtime (standard Electron entitlements);
+	     Laid 2026-09-17; corrected 2026-10-08 against current electron-builder
+	     docs:
+	     - allow-jit: Electron's V8 JIT needs it under hardened runtime — the
+	       one exception modern Electron requires;
+	     - allow-unsigned-executable-memory: DROPPED 2026-10-08 — a 2019-era
+	       Electron relic, not needed by modern V8/Electron (44), and it
+	       weakens the hardened runtime for no benefit;
 	     - audio-input: macOS mic for the STT milestone (the Developer-ID
 	       variant — com.apple.security.device.microphone is the App-Store
 	       sandbox variant and does NOT apply to Developer ID apps). -->
 	<key>com.apple.security.cs.allow-jit</key>
 	<true/>
-	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
-	<true/>
 	<key>com.apple.security.device.audio-input</key>
 	<true/>
 </dict>