WhisperDictate.entitlements: non-sandboxed hardened-runtime entitlements
(app-sandbox=false; cs.disable-library-validation for the bundled whisper-cli
+ ggml/whisper dylibs). Used to deep-sign the app with the company Developer ID
identity before notarization. Also ignore the stray Contents/CodeResources
signing artifact.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
