fix(desktop): let CLI flag drive mac DMG arch

The publish-desktop matrix passes `--arm64`/`--x64` per leg, but the
config-level `arch: ["arm64", "x64"]` on each mac.target object
overrode those flags. Every matrix leg built both archs from its own
single-arch sidecar binary; combined with `--clobber` uploads, both
shipped DMGs ended up carrying the x86_64 sidecar (errno -86 EBADARCH on
Apple Silicon). Drop the in-config arch list and let the CLI flag
restrict, matching the pattern opencode/t3code use.

Author: RhysSullivan

.changeset/desktop-mac-arch-mismatch.md

@@ -0,0 +1,12 @@
+---
+"@executor-js/desktop": patch
+"executor": patch
+---
+
+Fix: macOS DMGs no longer ship a mismatched-architecture sidecar binary.
+electron-builder's `--arm64` / `--x64` CLI flags are overridden when the
+config-level target objects pin `arch: ["arm64", "x64"]`, so every matrix
+leg was building both archs from the same single-arch sidecar. Combined
+with `--clobber` release uploads, the final DMGs carried the x86_64
+sidecar everywhere, breaking spawn on Apple Silicon (errno -86 EBADARCH).
+Drop the in-config arch list and let the per-leg CLI flag restrict.

apps/desktop/electron-builder.config.ts

@@ -26,10 +26,12 @@ const config: Configuration = {
   ],
   mac: {
     category: "public.app-category.developer-tools",
-    target: [
-      { target: "dmg", arch: ["arm64", "x64"] },
-      { target: "zip", arch: ["arm64", "x64"] },
-    ],
+    // Do NOT pin `arch:` inside the target objects. The publish workflow's
+    // matrix passes `--arm64` / `--x64` per leg; a config-level arch list
+    // would override that flag and force every leg to build both archs from
+    // a single per-leg sidecar binary, shipping mismatched-arch DMGs (errno
+    // -86 / EBADARCH on Apple Silicon). The CLI flag is the source of truth.
+    target: ["dmg", "zip"],
     hardenedRuntime: true,
     gatekeeperAssess: false,
     // electron-builder reads CSC_LINK / CSC_KEY_PASSWORD for the signing