v0.44.3 — CiteVahti.app ships again: signing fix completed (Python.framework excluded from mangling)

Packaging-only patch; no engine, safety, or write-path behaviour changed. Completes the 0.44.x signing series — this is the release that actually ships the signed CiteVahti.app with the sidecar architecture (and with it the in-app Zotero-connect keyring fix and the panel-assets fix for the app's agent sidecar).

Fixed

• codesign --verify --strict failed on the CI-built app after 0.44.2's dotted-dir mangling. CI builds with a framework Python, so each sidecar's _internal contains a real Python.framework — a genuine nested bundle codesign signs inside-out on its own. The blanket mangle renamed it, breaking that ordering. The mangle step now excludes *.framework subtrees and only renames non-bundle dotted directories. Verified locally on the CI-identical framework-Python layout: strict verify passes, both signed sidecars serve the panel, and the keychain-stored Zotero key resolves.

⚠ Updating

• CiteVahti.app: replace your old app with this release's citevahti-0.44.3-macos-arm64.app.zip — earlier apps predate the in-app keyring fix (Zotero connect) entirely.
• Claude Desktop extension (.mcpb): Desktop caches the old one — remove the CiteVahti extension, fully quit and reopen Claude Desktop, then install the new .mcpb; confirm with the status tool that it reports 0.44.3.