packaging(macos): retry stapling when Apple's ticket lookup drops (#8995)

* packaging(macos): retry stapling when Apple's ticket lookup drops

The 0.15.0 release's macOS job failed after both notarizations were
accepted: stapling the DMG lost its connection to Apple's CloudKit
ticket service (error 68). Retry stapling up to five times with a
growing pause before failing the job.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* packaging(macos): retry stapler validation too

The re-run of the 0.15.0 macOS job stapled the DMG, then lost the
CloudKit connection in `stapler validate` (error 68 again). Retry
staple + validate as a pair in package.sh, and retry the validation
verify.sh does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

packaging/macos/package.sh

@@ -97,6 +97,24 @@ notarize() {
   fi
 }
 
+# Stapling and validating both look the ticket up in Apple's CloudKit service. Right after
+# notarization that lookup can drop the connection ("The network connection was lost", error 68)
+# even though the ticket exists, so retry the pair a few times before failing the release.
+staple() {
+  local file="$1" attempt
+  for attempt in 1 2 3 4 5; do
+    if xcrun stapler staple "$file" && xcrun stapler validate "$file"; then
+      return
+    fi
+    if [ "$attempt" = 5 ]; then
+      echo "error: stapling $(basename "$file") failed after $attempt attempts" >&2
+      exit 1
+    fi
+    echo "stapling $(basename "$file") failed (attempt $attempt); retrying in $((attempt * 20))s" >&2
+    sleep $((attempt * 20))
+  done
+}
+
 # ---- PhotoCraft.app ----------------------------------------------------------------------------
 echo "==> assembling $APP"
 mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
@@ -123,8 +141,7 @@ codesign --verify --strict --deep --verbose=2 "$APP"
 if [[ "$NOTARIZE" = 1 ]]; then
   ditto -c -k --keepParent "$APP" "$WORK/PhotoCraft-notarize.zip"
   notarize "$WORK/PhotoCraft-notarize.zip"
-  xcrun stapler staple "$APP"
-  xcrun stapler validate "$APP"
+  staple "$APP"
   spctl --assess --type execute -vvv "$APP"
 fi
 
@@ -149,8 +166,7 @@ sign "$DMG"
 codesign --verify --strict --verbose=2 "$DMG"
 if [[ "$NOTARIZE" = 1 ]]; then
   notarize "$DMG"
-  xcrun stapler staple "$DMG"
-  xcrun stapler validate "$DMG"
+  staple "$DMG"
   spctl --assess --type open --context context:primary-signature -vvv "$DMG"
 fi