chore(deps): bump electron-builder to 26.18.0 - #9893

Summary

• Bumps electron-builder 26.15.3 → 26.18.0 in apps/desktop (devDependency). Lockfile moves only the builder family (app-builder-lib/dmg-builder/electron-publish/electron-builder-squirrel-windows 26.18.0, builder-util 26.16.0, @electron/rebuild 4.2.1, plus a nested @noble/hashes@1 for app-builder-lib).
• electron-updater is versioned independently and already on its latest 6.x (6.8.12), so it is not part of this bump.
• No Sim code or config changes. Relevant upstream changes for Sim's config (macOS dmg + zip, universal, hardened runtime, notarize, publish: github used only for app-update.yml):
  • Workspace production-dependency collection fixes (26.15.6) and workspace/mapped-destination path containment for asar (26.18.0): the packaged app.asar is byte-identical before and after (below).
  • macOS zip is created with 7-Zip -snl again instead of the native zip -y path that 26.15.x used; symlinks are preserved and the extracted app passes codesign --verify --deep --strict (below).
  • Electron's LICENSE.electron.txt and LICENSES.chromium.html are now retained in Contents/Resources (license compliance; two new files in the bundle, outside the asar).
  • set-key-partition-list now gets the temp keychain password. Only used when electron-builder imports CSC_LINK itself; our release workflow prepares its own keychain and passes CSC_KEYCHAIN, so that path is not taken.
  • mac dmg/zip blockmaps still use the default chunker (the new finer chunking applies only to NSIS store-asar). dmg-builder and the GitHub publisher have no code changes. The rest (NSIS, snap, flatpak, pnpm, squirrel, gitlab, MAS afterSign) doesn't apply to our targets.

Type of Change

• Other: dependency upgrade

Testing

Unsigned local packages on 26.15.3 and 26.18.0 from the same dist/ (CSC_IDENTITY_AUTO_DISCOVERY=false, --publish never, ad-hoc identity, hardened runtime off, arm64; the icon was swapped for a PNG because this machine has no Xcode 26 actool, identical for both runs):

• --mac dir: app.asar is byte-identical (cmp), and so is app.asar.unpacked. Its file list (3,633 entries) has the expected production deps (@sim/* workspace packages, electron-updater, @lydell/node-pty + both darwin prebuilds, etc.), no devDependencies, and the ../sim font mapping still lands at static/SeasonSansUprightsVF.woff2. Info.plist is identical. The only bundle difference is the two license files above.
• --mac zip: extracted with ditto -x -k (how Squirrel.Mac unpacks updates). Both versions keep all 14 symlinks with identical targets, every *.framework/Versions/Current is a symlink, codesign --verify --deep --strict passes, the embedded app.asar and app-update.yml are identical, and latest-mac.yml has the same shape.
• CI desktop-e2e / package-smoke builds the universal unsigned app and runs the packaged smoke suite on this PR.

Only a signed release run can confirm these: Developer ID signing + notarization of the universal dmg/zip, and the .icon → Assets.car/icns path with the newer icons toolset (needs Xcode 26).

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code