Avoid the macOS case-insensitive app/CLI build collision

AGENTS.md

@@ -189,8 +189,8 @@ what we take vs. skip). Never vendor it into the build.
 - No third-party deps beyond `github.com/coder/websocket`,
   `golang.org/x/crypto` (ACME), and `fyne.io/fyne/v2` (desktop UI). Keep it
   that way unless a milestone calls for it.
-- **Releases**: `v0.2.0` (tag on `d5689ce`) is published on Gitea with
-  darwin/linux CLI tarballs and a **notarized** `Tunnel-0.2.0.zip`
+- **Releases**: `v0.2.1` (tag on `5f98c28`) is published on Gitea with
+  darwin/linux CLI tarballs and a **notarized** `Tunnel-0.2.1.zip`
   (`spctl` = accepted / `Notarized Developer ID`). Homebrew: formula
   `tzgyn-tunnel` (CLI, installs `tunnel`) and cask `tzgyn-tunnel-app` (desktop,
   installs `Tunnel.app`), both in `TZGyn/homebrew-tap`. Rebuild the app with
@@ -202,6 +202,11 @@ what we take vs. skip). Never vendor it into the build.
   desktop app runs the service in-process. `tunnel check [route]` and the
   desktop **Check now** button check the local TCP target plus a public TLS
   handshake (DNS, proxy, bridge, certificate); public checks use a 5s deadline.
+- **macOS is case-insensitive**: `.local/tunnel` (CLI) and `.local/Tunnel`
+  (desktop) are the same file. The desktop scripts build to
+  `.local/desktop/Tunnel`; use `.local/tunnel-cli` when testing both
+  side-by-side. Symptom of a collision: `tunnel check` opens a GUI window and
+  `check` hangs/does nothing.
 - Milestones: M1 core data path (done); M2 real ACME DNS-01 + renewals (done);
   M3 rate limits/admin/hardening (done); M4 Go client (done); M5 desktop app
   (done). Remaining optional work: launchd/systemd agents for the Go client,

scripts/build-desktop-app.sh

@@ -16,11 +16,11 @@ if [ ! -x "$FYNE" ]; then
   FYNE="$(go env GOPATH)/bin/fyne"
 fi
 
-mkdir -p .local
-go build -o .local/Tunnel -ldflags "-X main.version=$VERSION" ./cmd/tunnel-desktop
+mkdir -p .local/desktop
+go build -o .local/desktop/Tunnel -ldflags "-X main.version=$VERSION" ./cmd/tunnel-desktop
 rm -rf Tunnel.app
 "$FYNE" package -os darwin \
-  -executable .local/Tunnel \
+  -executable .local/desktop/Tunnel \
   -name Tunnel -app-id dev.tzgyn.tunnel \
   -app-version "$VERSION" -app-build "$BUILD" \
   -icon assets/icon.png -release

scripts/release-desktop-app.sh

@@ -21,11 +21,11 @@ FYNE="$(command -v fyne || true)"
 IDENT="$(security find-identity -v -p codesigning | awk '/Developer ID Application:/{print $2; exit}')"
 [ -n "$IDENT" ] || { echo "no Developer ID Application identity"; exit 1; }
 
-mkdir -p "$OUT"
-go build -o .local/Tunnel -ldflags "-X main.version=$VERSION" ./cmd/tunnel-desktop
+mkdir -p "$OUT" .local/desktop
+go build -o .local/desktop/Tunnel -ldflags "-X main.version=$VERSION" ./cmd/tunnel-desktop
 rm -rf "$APP"
 "$FYNE" package -os darwin \
-  -executable .local/Tunnel \
+  -executable .local/desktop/Tunnel \
   -name Tunnel -app-id dev.tzgyn.tunnel \
   -app-version "$VERSION" -app-build "$BUILD" \
   -icon assets/icon.png -release