app_icons table (macOS 27): every app returns "tiff: unsupported feature: sample format" #58753

Fleet versions

• Discovered: fleetd 1.63.0 (orbit 1.63.0), Fleet rc-minor-fleet-v4.95.0 (f231ce6)
• Reproduced: fleetd rc-minor-fleetd-v1.64.0 (2d359ff)

Web browser and operating system: N/A (fleetd table). Host: macOS 27.0.1 (26A434), Apple Silicon

💥 Actual behavior

On macOS 27, app_icons returns error generating table: decoding tiff bytes: tiff: unsupported feature: sample format for every real application, so the table never returns an icon. A join like apps JOIN app_icons fails as a whole on the first app and returns no rows.

🛠️ Expected behavior

app_icons returns the app's icon (path, icon, hash) for an application path. It still does this for paths that get the generic document icon (e.g. a nonexistent path or /etc/hosts).

🧑‍💻 Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. On a macOS 27 host enrolled with fleetd, run a live report: SELECT path, hash FROM app_icons WHERE path = '/System/Applications/Calculator.app'
2. The host returns the error above and no rows. Same for /Applications/Safari.app and any other app.
3. SELECT path, hash FROM app_icons WHERE path = '/etc/hosts' returns a row, for comparison.

🕯️ More info (optional)

• On macOS 27, NSBitmapImageRep's TIFFRepresentation of an app icon is 16-bit floating-point RGBA (SampleFormat=3, BitsPerSample=16). The generic document icon is still 8-bit unsigned (SampleFormat=1). golang.org/x/image/tiff (v0.45.0, reader.go:262) accepts only SampleFormat=1, so tiff.Decode in orbit/pkg/table/app-icons/app_icons_darwin.go:101 fails.
• Seen on a macOS 27 UTM VM through Fleet live reports, and on a physical Apple Silicon Mac (macOS 27.0.1) by calling getAppIcon directly. Not checked on macOS 26 or earlier.
• Found while QA'ing Possible memory leak: C.CString(appPath) is never freed in getAppIcon #52655 (same table, unrelated leak fix).