build: prepare unsigned macOS test prerelease and refresh safe build dependencies

docs/mac-test.md

@@ -0,0 +1,31 @@
+# macOS test build — 0.1.1-mac.1
+
+This is an unsigned, unnotarized test prerelease. It has been packaged on Linux; it has NOT been launched or playback-tested on macOS. Do not treat it as an approved customer release.
+
+## Build
+
+Based on main commit `2c93670aafd04f05e4e14b803f4bf0eeab6dd991`. Player code is unchanged. Version metadata and three vulnerable build-time transitive dependencies were updated (xmldom, fast-uri, js-yaml).
+
+```sh
+npm ci
+npm run check
+npm audit
+CSC_IDENTITY_AUTO_DISCOVERY=false npx electron-builder --mac zip --arm64 --x64 --publish never
+```
+
+Linux Electron launch smoke: `npm run smoke:headless`. This checks the shared application, not the macOS executable.
+
+ZIP packaging works on Linux with this electron-builder version. Signing/notarization and a native macOS launch test remain separate gates. No claim is made that an unsigned app will pass Gatekeeper or Apple Silicon signature enforcement.
+
+## Test on a Mac
+
+1. Apple menu > About This Mac: Apple M-series uses arm64; Intel uses x64.
+2. Download the matching ZIP from this prerelease and extract it.
+3. Move Alta Video Player.app to Applications and try opening it.
+4. If macOS blocks it, report the exact message. Do not disable Gatekeeper globally. A scoped Open Anyway option may be available under System Settings > Privacy & Security for this trusted test build; signature failures may instead require a Mac-built/ad-hoc-signed replacement.
+5. Import a known video, then a representative export ZIP (including an encrypted one if available).
+6. Check playback, seeking, speed, multiple camera synchronization and zoom.
+7. Check integrity/certificate verification with a known export.
+8. Quit and reopen. Report macOS version, processor, and any errors. Keep customer footage and export contents out of GitPeji issues.
+
+Production remains on its existing stable release. This prerelease does not deliberately change the production download button; publish validated Mac assets to the stable release only after acceptance, retaining Windows downloads.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "webavp-desktop",
-  "version": "0.1.0",
+  "version": "0.1.1-mac.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "webavp-desktop",
-      "version": "0.1.0",
+      "version": "0.1.1-mac.1",
       "devDependencies": {
         "electron": "^43.4.1",
         "electron-builder": "^26.15.3"
@@ -734,9 +734,9 @@
       }
     },
     "node_modules/@xmldom/xmldom": {
-      "version": "0.8.14",
-      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.14.tgz",
-      "integrity": "sha512-T4EDRUBVZYRldYApjEJiU0e1stYWaRAX7CuSnKzrpwdZKo53zGV8/pqfzV6FfwNl9YThD2OumQYvqtvjvgG7aQ==",
+      "version": "0.8.15",
+      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.15.tgz",
+      "integrity": "sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2026,9 +2026,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
-      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
+      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
       "dev": true,
       "funding": [
         {
@@ -2551,9 +2551,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "dev": true,
       "funding": [
         {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "webavp-desktop",
-  "version": "0.1.0",
+  "version": "0.1.1-mac.1",
   "private": true,
   "description": "Standalone desktop shell for Alta Video Player.",
   "desktopName": "alta-video-player.desktop",