fix(release): bundle macos-bundle-updater.sh inside freenet crate

## Problem

`cargo install freenet --version 0.2.61` (and every subsequent
published version) fails to build from crates.io with an
`include_str!` "file not found" error on
`crates/core/src/bin/commands/update.rs`.

The line
`include_str!("../../../../../scripts/macos-bundle-updater.sh")`
walks five levels up — out of the freenet crate and into the
workspace-root `scripts/` directory. That path is valid in a
workspace checkout, but `cargo publish` only bundles files inside
the crate directory, so the script is absent from the registry
tarball and `cargo build` aborts before linking.

This blocks anyone installing freenet from the registry rather than
from source, including River's `cargo make sign-webapp` flow, which
shells out to `cargo install freenet` to obtain `fdev`.

## Approach

Move `scripts/macos-bundle-updater.sh` into the freenet crate at
`crates/core/scripts/macos-bundle-updater.sh` so `cargo publish`
ships it. Shorten the `include_str!` path accordingly.

Why this over alternatives — the script is the only file the
freenet binary embeds via `include_str!`; the rest of the
workspace-root `scripts/` directory is build/CI tooling that
shouldn't ride along in the published crate. A `[package].include`
allowlist or a `build.rs` that copies the file would add
configuration to maintain but would not surface the rule at the
filesystem level. Co-locating the embedded resource with its
consumer crate is the convention `cargo` was designed around.

## Testing

A bug in this class is the published `.crate` tarball missing an
embedded resource — that can't be caught by a runtime `#[test]`
alone, so this PR closes the gap with TWO tests:

1. **Unit test** — a new `#[test]` in `update.rs::tests`
   re-includes the script via `include_str!` and asserts its shape
   (shebang + header). Locks the path: any future refactor that
   walks back outside the crate breaks compilation right here.

2. **CI gap test** — a new step in the `fmt_check` job runs
   `cargo package --list -p freenet` and fails the build if
   `scripts/macos-bundle-updater.sh` is missing from the would-be
   tarball. This is the assertion that would actually have caught
   the 0.2.61 regression before publish, and it generalizes to any
   future embedded resource that gets added to the include list.

The workspace e2e harness
(`scripts/macos-bundle-swap-e2e.sh` and its `.c` stub comment)
was updated to point at the new path.

Local validation:

- `cargo fmt -- --check` clean.
- `cargo clippy -p freenet --bin freenet --tests -- -D warnings`
  clean.
- New test passes:
  `cargo test embedded_updater_script_resolves_inside_freenet_crate`.
- `cargo package --list -p freenet | grep -Fx scripts/macos-bundle-updater.sh`
  resolves — the script is in the package contents.

The `#[cfg(target_os = "macos")]` gate on `write_updater_script`
is unchanged, so Linux builds remain unaffected.

## Why didn't CI catch this?

CI ran `cargo build` / `cargo test` against the workspace
checkout, where the workspace-root `scripts/` directory is on disk
and `include_str!` resolves. CI never built the crate from its
published `.crate` tarball, so the packaging gap was invisible. The
new `fmt_check` step closes that gap and would have failed the
0.2.61 release PR before it merged.

## Fixes

Unblocks `cargo install freenet` from crates.io and downstream
tooling that depends on it (River's `cargo make sign-webapp`).
Recommend cutting a `0.2.63` patch release after merge so
downstreams can stop vendoring around this.

[AI-assisted - Claude]

Entire-Checkpoint: 046245fb4905

Author: SalvatoreT

.github/workflows/ci.yml

@@ -148,6 +148,33 @@ jobs:
             exit 1
           fi
 
+      # Regression gate for #4240: cargo publish only bundles files
+      # inside the crate, so an include_str! path that walks outside
+      # the crate root ships a broken tarball that fails to build for
+      # crates.io users.
+      - name: Verify freenet crate package includes embedded resources
+        run: |
+          set -eu
+          required=(
+            scripts/macos-bundle-updater.sh
+          )
+          package_list=$(cargo package --list -p freenet)
+          fail=0
+          for f in "${required[@]}"; do
+            if ! echo "$package_list" | grep -qFx "$f"; then
+              echo "::error::Missing from published freenet crate: $f"
+              fail=1
+            fi
+          done
+          if [ "$fail" -ne 0 ]; then
+            echo "Files referenced by include_str!/include_bytes! must live"
+            echo "inside crates/core/ so cargo publish bundles them."
+            echo
+            echo "Package contents:"
+            echo "$package_list"
+            exit 1
+          fi
+
   # Grep-based lint for banned patterns in crates/core/ (DST-breaking APIs).
   # Only checks added lines in the diff — pre-existing violations are grandfathered.
   # Fast (~2s on GitHub-hosted runner), no Rust toolchain needed.

scripts/macos-bundle-updater.sh …tes/core/scripts/macos-bundle-updater.shscripts/macos-bundle-updater.sh renamed to crates/core/scripts/macos-bundle-updater.sh scripts/macos-bundle-updater.sh renamed to crates/core/scripts/macos-bundle-updater.sh

@@ -1552,7 +1552,7 @@ fn hdiutil_detach(mount_point: &Path) -> Result<()> {
 /// even when installed from crates.io without the `scripts/` directory.
 #[cfg(target_os = "macos")]
 fn write_updater_script() -> Result<PathBuf> {
-    const SCRIPT: &str = include_str!("../../../../../scripts/macos-bundle-updater.sh");
+    const SCRIPT: &str = include_str!("../../../scripts/macos-bundle-updater.sh");
     let dir = updater_runtime_dir()?;
     std::fs::create_dir_all(&dir)?;
     let path = dir.join("macos-bundle-updater.sh");
@@ -1748,4 +1748,18 @@ mod tests {
         // silently eat both leading chars): verify we strip just one.
         assert_eq!(macos_dmg_asset_name("vv0.2.49"), "Freenet-v0.2.49.dmg");
     }
+
+    #[test]
+    fn embedded_updater_script_resolves_inside_freenet_crate() {
+        // Regression for #4240 — the include_str! path used to walk
+        // outside the crate, so cargo publish dropped the script and
+        // `cargo install freenet` failed at build time. Re-included
+        // here so non-macOS CI also exercises the path. The packaging
+        // half is asserted in .github/workflows/ci.yml.
+        const SCRIPT: &str = include_str!("../../../scripts/macos-bundle-updater.sh");
+        assert!(
+            SCRIPT.contains("macOS DMG-swap updater"),
+            "include_str! resolved to the wrong file"
+        );
+    }
 }

crates/core/src/bin/commands/update.rs

@@ -3,7 +3,7 @@
  * via clang and dropped into each test .app bundle as Contents/MacOS/
  * freenet-bin.
  *
- * Rationale: the updater script (scripts/macos-bundle-updater.sh) uses
+ * Rationale: the updater script (crates/core/scripts/macos-bundle-updater.sh) uses
  * `pgrep -f "^${bundle}/Contents/MacOS/"` to detect the running Freenet
  * process. That pattern assumes the kernel invoked a real Mach-O at the
  * bundle path, so the process command line begins with that path. A

scripts/macos-bundle-swap-e2e-stub.c

@@ -1,5 +1,5 @@
 #!/bin/bash
-# End-to-end test for scripts/macos-bundle-updater.sh.
+# End-to-end test for crates/core/scripts/macos-bundle-updater.sh.
 #
 # Builds two minimal unsigned .app bundles ("v1" and "v2"), launches v1 via
 # /usr/bin/open, invokes the updater script with v2 staged as a sibling,
@@ -26,7 +26,7 @@
 set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-UPDATER="$REPO_ROOT/scripts/macos-bundle-updater.sh"
+UPDATER="$REPO_ROOT/crates/core/scripts/macos-bundle-updater.sh"
 STUB_SRC="$REPO_ROOT/scripts/macos-bundle-swap-e2e-stub.c"
 
 if [[ ! -x "$UPDATER" ]]; then