v0.44.2 — CiteVahti.app signable again; its agent sidecar had the blank-panel bug too

ℹ The CiteVahti.app fix described below didn't ship with this release

This release's macos-app CI job still failed (the mangling also renamed the CI Python's real Python.framework, breaking codesign's inside-out bundle signing). The signed, notarized, stapled app first ships with v0.44.3 — get citevahti-0.44.3-macos-arm64.app.zip from there. The three .mcpb files attached here are fine.

Packaging-only patch; no engine, safety, or write-path behaviour changed. Completes v0.44.1: that release's CiteVahti.app never shipped because the CI codesign step failed on the new sidecar bundle layout.

Fixed

• codesign --deep failed on the sidecar bundle layout, so no signed CiteVahti.app could be built since the shell+sidecars architecture landed. The two --onedir sidecars live under Contents/MacOS/, and codesign treats their dotted directories (*.dist-info, python3.11) as unrecognized nested bundles. build-app.sh now applies PyInstaller's own codesign-safe trick (the shell bundle already ships Frameworks/python3__dot__11): the real directory is renamed with dots mangled to __dot__ and a same-name symlink left behind. Verified on a locally signed bundle: strict verify passes, both sidecars serve the panel, and the keychain-stored Zotero key resolves through the symlinked keyring metadata.
• The app's citevahti-mcp sidecar had the 0.44.1 blank-panel bug too (its freeze flags were copied from build-binary.sh including the missing --collect-data citevahti). Fixed; the fail-loud freeze guard now checks panel assets in both sidecars.

⚠ Updating

• Claude Desktop extension (.mcpb): Desktop caches the old one — remove the CiteVahti extension, fully quit and reopen Claude Desktop, then install the new .mcpb; confirm with the status tool that it reports 0.44.2.
• CiteVahti.app: replace the old app with this release's citevahti-0.44.2-macos-arm64.app.zip — earlier apps predate the in-app keyring fix (Zotero connect) entirely.