v0.2.1

Added

• The wizard now auto-detects a portable REAPER sitting in RABBIT's own
  folder. If you drop rabbit next to a portable REAPER (reaper.exe +
  reaper.ini on Windows, a REAPER*.app bundle on macOS), that install is
  discovered as a target and selected by default — so you can check for
  updates straight away without going through the Browse button.

Changed

• macOS builds are now signed with an Apple Developer ID and notarized by
  Apple (then stapled) when the release's MACOS_* signing secrets are
  configured. Gatekeeper trusts a notarized bundle on first launch, so the
  download is just "unzip and double-click Rabbit.app" — the
  Open Me First.command quarantine helper is gone from signed builds. Forks
  and credential-less builds still fall back to ad-hoc signing with the
  helper. A new manual macos-signing-smoke workflow exercises and verifies
  the full sign → notarize → staple path so it can be validated before a
  release tag.

Fixed

• Elevated NSIS installers now receive their /D=<path> install-directory
  flag correctly, so packages whose vendor installer is NSIS land in the
  REAPER folder RABBIT planned instead of NSIS's default
  C:\Program Files\REAPER (x64)\. quote_one was doubling every
  backslash and wrapping the flag in double quotes, but NSIS reads /D=
  straight from GetCommandLine() and takes everything after it verbatim
  to end-of-string — so the quoted path arrived with a trailing " baked
  into the directory name (an invalid path). NSIS fell back to its default
  location, and post-install verification at the planned path then
  surfaced the installer's 1223 exit code as a hard error, leaving every
  package after REAPER unprocessed. /D=… arguments are now passed
  unquoted and last as NSIS requires, and backslash escaping follows the
  Windows command-line spec (only backslashes immediately before a " are
  doubled). Windows only. Fixed in PR #6 by @trypsynth.
• Self-update apply on macOS no longer leaves the swapped binary
  non-executable. The staged source is the bare universal Mach-O off
  the GitHub release, and HTTPS downloads strip Unix mode bits, so
  fs::copy propagated a 0o644 mode onto Rabbit.app/Contents/MacOS/rabbit.
  Finder then labelled the file "document" instead of "Unix executable"
  and the bundle refused to launch — even though codesign --force --deep
  succeeded on it. swap_install_file now re-asserts 0o755 on the
  install target right after the copy, before the bundle re-sign step.
  No-op on Windows. Reported in issue #5.
• Self-update apply in the GUI now exits the old RABBIT process after
  spawning the relaunched copy. Previously the swap completed and the
  new version launched, but the pre-update window kept running next to
  it because the apply callback never asked the wx event loop to shut
  down. The relaunch path now mirrors the language-switch relaunch and
  calls std::process::exit(0) once the new process has been spawned;
  the error path is unchanged so a failed spawn still leaves the
  original window open. CLI apply --restart was already correct.