Summary

• Remove the spctl --assess Gatekeeper check from prepareMacOSDaemonBinary() — ad-hoc signed binaries always fail this check on modern macOS since it enforces Apple notarization policy, which is not required for Homebrew-distributed CLI tools
• Fix pre-existing test bug where caskRoot was computed before filepath.EvalSymlinks, causing test failures on macOS (where /var/folders/... resolves to /private/var/folders/...)
• Replace the spctl failure context test with an equivalent codesign failure context test

Fixes #244

Test plan

• All existing tests pass (go test ./...)
• Install via Homebrew Cask and verify vigilante setup -d succeeds without the spctl rejection error
• Verify the daemon loads and runs correctly via launchctl

🤖 Generated with Claude Code