ENOENT: no such file or directory, open '/Applications/PawWork.app/Contents/Resources/app-update.yml'\n```\n\n## Evidence\n\nThe installed app bundle and the v0.2.7 release zip both do not contain `PawWork.app/Contents/Resources/app-update.yml`. The GitHub release does contain `latest-mac.yml`, so the missing file is inside the packaged app bundle, not the remote updater metadata.\n\nThe likely build-flow gap is the split macOS notarization path: the submit phase packages only `dir` with `--publish never`, while the finalize phase wraps the already signed prepackaged app into dmg/zip. electron-builder writes `app-update.yml` from the macOS `afterPack` publish path when dmg/zip targets are present, so the two-phase flow can produce a signed app before that local updater config exists.\n\n## Expected\n\nmacOS release artifacts include `Contents/Resources/app-update.yml` before signing and notarization, and release verification fails if the file is missing.\n\n## Scope\n\nFix the macOS packaging path so prod/beta app bundles contain `app-update.yml` before signing. Add release verification coverage that inspects the packaged macOS app bundle, not only the release-level `latest-mac.yml` asset.