Bundle the first-party Python scripting plugin

packaging/build_macos_signed.sh

@@ -89,6 +89,8 @@ cp "target/$TARGET/release/OpenCADStudio" "$APP/Contents/MacOS/OpenCADStudio-App
 chmod +x "$APP/Contents/MacOS/OpenCADStudio" "$APP/Contents/MacOS/OpenCADStudio-App"
 cp "$DIST/AppIcon.icns" "$DIST/DWG.icns" "$DIST/DXF.icns" "$APP/Contents/Resources/"
 cp -R "$EXT" "$APP/Contents/PlugIns/"
+bash plugins/opencad-python/tools/stage-bundled.sh \
+    "$APP/Contents/Resources/plugins/opencad.python" --target "$TARGET"
 sed "s/__VERSION__/$VERSION/g" packaging/Info.plist > "$APP/Contents/Info.plist"
 
 echo "==> codesign"
@@ -104,6 +106,8 @@ if [ "$DEVELOPER_ID" = "-" ]; then
     # not the blocker here — carrying the entitlements through is.
     codesign --force --sign - --timestamp=none \
         "$APP/Contents/MacOS/OpenCADStudio-App"
+    codesign --force --sign - --timestamp=none \
+        "$APP/Contents/Resources/plugins/opencad.python/libopencad_python.dylib"
     codesign --force --sign - --timestamp=none \
         --entitlements crates/dwg-thumbnailer/macos/entitlements.plist \
         "$APP/Contents/PlugIns/DWGThumbnail.appex"
@@ -114,6 +118,9 @@ else
     # and a secure timestamp on every layer for notarization.
     codesign --force --timestamp --options runtime \
         -s "$DEVELOPER_ID" "$APP/Contents/MacOS/OpenCADStudio-App"
+    codesign --force --timestamp --options runtime \
+        -s "$DEVELOPER_ID" \
+        "$APP/Contents/Resources/plugins/opencad.python/libopencad_python.dylib"
     codesign --force --timestamp --options runtime \
         --entitlements crates/dwg-thumbnailer/macos/entitlements.plist \
         -s "$DEVELOPER_ID" "$APP/Contents/PlugIns/DWGThumbnail.appex"