Avoid the macOS case-insensitive app/CLI build collision

AGENTS.md

@@ -189,8 +189,8 @@ what we take vs. skip). Never vendor it into the build.
 - No third-party deps beyond `github.com/coder/websocket`,
   `golang.org/x/crypto` (ACME), and `fyne.io/fyne/v2` (desktop UI). Keep it
   that way unless a milestone calls for it.
-- **Releases**: `v0.2.0` (tag on `d5689ce`) is published on Gitea with
-  darwin/linux CLI tarballs and a **notarized** `Tunnel-0.2.0.zip`
+- **Releases**: `v0.2.1` (tag on `5f98c28`) is published on Gitea with
+  darwin/linux CLI tarballs and a **notarized** `Tunnel-0.2.1.zip`
   (`spctl` = accepted / `Notarized Developer ID`). Homebrew: formula
   `tzgyn-tunnel` (CLI, installs `tunnel`) and cask `tzgyn-tunnel-app` (desktop,
   installs `Tunnel.app`), both in `TZGyn/homebrew-tap`. Rebuild the app with
@@ -202,6 +202,11 @@ what we take vs. skip). Never vendor it into the build.
   desktop app runs the service in-process. `tunnel check [route]` and the
   desktop **Check now** button check the local TCP target plus a public TLS
   handshake (DNS, proxy, bridge, certificate); public checks use a 5s deadline.
+- **macOS is case-insensitive**: `.local/tunnel` (CLI) and `.local/Tunnel`
+  (desktop) are the same file. The desktop scripts build to
+  `.local/desktop/Tunnel`; use `.local/tunnel-cli` when testing both
+  side-by-side. Symptom of a collision: `tunnel check` opens a GUI window and
+  `check` hangs/does nothing.
 - Milestones: M1 core data path (done); M2 real ACME DNS-01 + renewals (done);
   M3 rate limits/admin/hardening (done); M4 Go client (done); M5 desktop app
   (done). Remaining optional work: launchd/systemd agents for the Go client,