fix(sandboxing): flatten native lib extraction to resources root

Native libs were extracted into platform-specific subdirectories
(e.g. darwin-aarch64/libjnidispatch.jnilib), which caused:
- jna.boot.library.path not finding libjnidispatch when set to the
  resources root (JNA looks directly in listed directories)
- Duplicate libs (e.g. libsqlite at root + in /aarch64 subdirectory)
- Universal macOS builds keeping separate arch binaries instead of
  merging them via lipo

Since the extraction already filters by target OS/arch, there are no
naming conflicts. Flattening to the root simplifies library path
configuration and removes the need for jnaPlatformPrefix().

Author: kdroidFilter

plugin-build/plugin/src/main/kotlin/io/github/kdroidfilter/nucleus/desktop/application/internal/configureJvmApplication.kt

@@ -859,37 +859,14 @@ private fun JvmApplicationContext.configurePackageUberJarForCurrentOS(
  * JNA-specific args are always included: they are harmless if JNA is not on the classpath
  * (the JVM simply ignores unknown system properties).
  *
- * `jna.boot.library.path` must include the platform-specific subdirectory (e.g. `darwin-aarch64`)
- * because JNA looks for `libjnidispatch` directly in the listed directories without adding
- * any platform prefix itself.
+ * Native libs are extracted flat into [resourcesPath] (no platform subdirectories),
+ * so a single directory entry is sufficient for all lookup mechanisms.
  */
-private fun sandboxingJvmArgs(resourcesPath: String): List<String> {
-    val sep = java.io.File.pathSeparator
-    val jnaPlatformDir = "$resourcesPath/${jnaPlatformPrefix()}"
-    return listOf(
-        "-Djava.library.path=$jnaPlatformDir$sep$resourcesPath",
+private fun sandboxingJvmArgs(resourcesPath: String): List<String> =
+    listOf(
+        "-Djava.library.path=$resourcesPath",
         "-Djna.nounpack=true",
         "-Djna.nosys=true",
-        "-Djna.boot.library.path=$jnaPlatformDir$sep$resourcesPath",
-        "-Djna.library.path=$jnaPlatformDir$sep$resourcesPath",
+        "-Djna.boot.library.path=$resourcesPath",
+        "-Djna.library.path=$resourcesPath",
     )
-}
-
-/**
- * Returns the JNA platform resource prefix for the current OS and architecture.
- * This matches the directory name JNA uses inside its JAR (e.g. `darwin-aarch64`, `linux-x86-64`).
- */
-private fun jnaPlatformPrefix(): String {
-    val os =
-        when (currentOS) {
-            OS.Windows -> "win32"
-            OS.Linux -> "linux"
-            OS.MacOS -> "darwin"
-        }
-    val arch =
-        when (currentArch) {
-            Arch.X64 -> "x86-64"
-            Arch.Arm64 -> "aarch64"
-        }
-    return "$os-$arch"
-}

plugin-build/plugin/src/main/kotlin/io/github/kdroidfilter/nucleus/desktop/application/tasks/AbstractExtractNativeLibsTask.kt

@@ -66,21 +66,16 @@ abstract class AbstractExtractNativeLibsTask : AbstractNucleusTask() {
                         val info = detectInfo(entry.name, zis)
                         if (shouldExtract(info, expectedOs, expectedArch)) {
                             val fileName = entry.name.substringAfterLast('/')
-                            // Preserve parent directory for libs that use path-based lookup (e.g. JNA
-                            // expects <boot.library.path>/darwin-aarch64/libjnidispatch.jnilib).
-                            // Universal-arch libraries go directly into the resources root so they
-                            // are found via the base java.library.path entry without needing
-                            // an architecture-specific subdirectory.
-                            val parentDir =
-                                entry.name
-                                    .substringBeforeLast('/', "")
-                                    .substringAfterLast('/')
-                            val relativePath =
-                                if (parentDir.isEmpty() || info.arch == NativeArch.UNIVERSAL) {
-                                    fileName
-                                } else {
-                                    "$parentDir/$fileName"
-                                }
+                            // Always flatten to the output root. We already filter by
+                            // target OS/arch so there are no naming conflicts, and
+                            // flattening is required for:
+                            //  1. macOS universal builds – lipo needs the same relative
+                            //     path in both the arm64 and x64 .app bundles.
+                            //  2. JNA boot library loading – jna.boot.library.path
+                            //     looks directly in the listed directories.
+                            //  3. Simplicity – a single java.library.path entry is
+                            //     enough for all native libs.
+                            val relativePath = fileName
                             if (fileName in extractedFiles) {
                                 logger.warn(
                                     "Sandboxing: skipping duplicate native lib" +