v0.1.2

Changed

• Self-update is now a modal Yes/No prompt at startup instead of a
  button on the wizard's Done page. The previous design was effectively
  unreachable: users had to finish an install before they ever saw the
  "Apply RABBIT update" button, and the always-visible status bar line
  pointed at a button most users couldn't find. The startup self-update
  check now raises a Yes/No dialog as soon as it completes; "Yes" runs
  the apply inline (with progress in the status bar) and relaunches
  RABBIT, "No" dismisses the prompt for the rest of the session. Users
  who change their mind can relaunch RABBIT to be re-prompted; the
  status-bar line spells that out.

Fixed

• Per-arch artifact dispatch on a fresh first-time install. On macOS
  with no existing /Applications/REAPER.app, the binary-header probe
  in standard_macos_installation couldn't read a file that wasn't
  there yet and returned Architecture::Unknown. The SWS and ReaPack
  resolvers then fell through to their Unknown → X64 fallback arms
  and downloaded sws-…-Darwin-x86_64.dmg and
  reaper_reapack-x86_64.dylib, even on Apple Silicon hosts running
  natively where the freshly-installed REAPER would launch as arm64
  and refuse to load the mismatched extension binaries. The dispatch-
  time canonicalizer (renamed from canonicalize_macos_universal_arch
  to canonicalize_dispatch_arch) now collapses Unknown to the host
  slice the same way it collapses Universal — Architecture::current()
  with Rosetta correction — so the upcoming install lands arch-correct
  plug-ins regardless of whether REAPER was already on disk when the
  wizard launched. The fix also closes the equivalent x64-fallback bug
  on Windows-on-ARM, where an unprobed target would have produced
  Windows-x64.exe SWS and reaper_reapack-x64.dll instead of the
  arm64ec variants.

• macOS Rosetta detection. v0.1.1 shelled out to /usr/sbin/sysctl -n sysctl.proc_translated to determine whether RABBIT was running
  under Rosetta, but sysctl.proc_translated reports the querying
  process's translation state — and the shelled-out sysctl binary
  always runs as the host's native arch (the kernel picks its native
  slice at exec time, ignoring the parent's translation state). The
  probe therefore always reported false, including when RABBIT
  itself was the translated x86_64 slice on Apple Silicon. The
  artifact dispatcher then canonicalized REAPER-Universal to
  Architecture::current() (i.e., X64) and installed x86_64
  plug-ins against an arm64-native REAPER process. The probe now
  calls sysctlbyname directly via FFI from RABBIT's own process, so
  the kernel resolves the key against RABBIT's translation state.

• macOS self-update used to leave Rabbit.app structurally invalid
  after the binary swap. The release pipeline now ad-hoc signs the
  bare rabbit-<version>-macos-universal artifact itself (so the
  staged-in binary has a valid embedded signature even though
  lipo -create strips its inputs' sigs), and apply_self_update
  re-seals the enclosing .app bundle with codesign --force --deep --sign - after the swap. Both pieces are needed: the bare-binary
  signing keeps Apple Silicon's exec checks happy and the bundle
  re-seal restores the _CodeSignature/CodeResources consistency that
  Gatekeeper checks on Finder launch. Without these, post-update
  Finder launches on macOS 15 (Sequoia) and 26 (Tahoe) would refuse
  the bundle as corrupt rather than just untrusted.