Installed Roll.app: unsigned bundle breaks TCC (camera silently denied) + sidecar not bundled (externalBin)

[StuMason]

Discovered while dogfooding the first dmg-installed Roll.app (2026-07-02). Dev mode (npm run tauri dev) masks all of this because the responsible app for TCC is the signed terminal/VS Code, whose camera grant covers the spawned sidecar.

What's broken for an installed app

1. The bundle and sidecar are completely unsigned (codesign -dvvv → "code object is not signed at all"). macOS TCC cannot build a code identity for an unsigned responsible app, so camera access is silently auto-denied — no prompt, no error; every camera sits at "connecting…" forever. Ad-hoc signing (codesign -s -) makes prompts work but the identity changes every rebuild → permissions re-prompt each build. Proper fix: sign with a Developer ID Application cert (bundle.macOS.signingIdentity in tauri.conf.json + a codesign step for the sidecar in scripts/build-sidecar.sh). Stu has certs available.
2. The sidecar never requested AV access — try? AVCaptureDeviceInput silently swallows the notDetermined failure. Fixed by ensureAVAccess() (explicit AVCaptureDevice.requestAccess for video+audio at --serve start and in one-shot record).
3. externalBin is not configured, so roll-capture isn't bundled into Roll.app — the installed app only works on a machine with the repo checkout, via the dev-path fallback in sidecar_path(). The triple-named binary is already staged by build-sidecar.sh; tauri.conf.json just never points at it.

Acceptance

• A fresh Roll.app install on a clean TCC state prompts for camera + mic on first use and records.
• Rebuilding the app does not re-prompt (stable signing identity).
• Roll.app runs on a machine without the repo checkout (sidecar bundled).

🤖 Generated with Claude Code

[StuMason]

Update from tonight: the missing requestAccess fix is in PR #18. Signing status: Stu's paid Developer Program membership has expired, so no Developer ID cert for now — options are renewing, or a free-tier personal-team Apple Development cert (sufficient for a stable local TCC identity; Developer ID only matters for distributing to other machines). /Applications/Roll.app was ad-hoc signed by hand tonight as a stopgap; day-to-day recording is happening via npm run tauri dev, which sidesteps all of this (the terminal is the TCC-responsible app).