…#1)

Two failures inherited from the latest upstream sync merge (ae9f745):

- test_model_catalog: code lists renamed minimax/minimax-m2.7 ->
  minimax/minimax-m3 but website/static/api/model-catalog.json was not
  regenerated. Ran scripts/build_model_catalog.py.

- test_gui_command: upstream PR NousResearch#36198 (79f7e7a) added
  _desktop_macos_relaunchable_fixup() to cmd_gui, which fires two extra
  subprocess.run calls (xattr + codesign) on darwin between pack and
  launch, but did not update the gui tests. The two darwin tests supplied
  only [pack_ok, launch_ok] as side_effect, so the launch call hit
  StopIteration. Mock the fixup helper in those tests, matching the
  existing pattern that mocks _run_npm_install_deterministic.

Co-authored-by: themasio <hugodamasio@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The upstream commit 79f7e7a (NousResearch#36198) added _desktop_macos_relaunchable_fixup()
which calls subprocess.run twice on macOS for xattr + codesign. The gui command
tests mock subprocess.run with a side_effect list that only covers the build
and launch calls, but the fixup function consumes additional side_effect
values, exhausting the iterator and raising StopIteration.

Fix: patch _desktop_macos_relaunchable_fixup() in both affected tests so
subprocess.run side_effect values are not consumed by fixup calls.

…e self-update (NousResearch#36198)

On macOS the desktop app is built locally and ad-hoc signed (no Developer ID
on the user's machine). An ad-hoc bundle has no stable Designated Requirement,
so when the self-updater rebuilds it in place with a fresh build (new cdhash)
— plus the com.apple.quarantine flag inherited from the downloaded installer
process chain — Gatekeeper/LaunchServices treats the changed code as tampering
and macOS reports "Hermes is damaged and can't be opened," and the app fails to
relaunch. First launch works (fresh registration); the in-place update relaunch
is what breaks.

Fix: after building the desktop app locally, strip quarantine xattrs and
re-apply a clean deep ad-hoc signature (omitting the hardened-runtime flag,
which an ad-hoc build can't satisfy). Applied in both build entry points:
- hermes_cli/main.py cmd_gui (the `hermes desktop --build-only` path the
  updater drives) — so the fix ships via `hermes update` (git), no installer
  re-download needed.
- scripts/install.sh install_desktop (first install) for parity.

Both are no-ops on non-macOS and when a real signing identity (CSC_LINK /
APPLE_SIGNING_IDENTITY) is configured, so signed/notarized builds are untouched.