[6k2]

What changes

Tether's Windows-oriented shortcuts, credential backend, shell discovery, file clipboard and release assets prevented a complete macOS experience. This adds native macOS behavior across local terminals, SSH/SFTP, agent hooks, fonts, settings and updates.

• Use Keychain, the account login shell, bounded login-shell PATH discovery, macOS font collections and private short Unix-socket paths for agent IPC.
• Adopt Command-based app shortcuts and Finder-style SFTP gestures while preserving physical Control-C/V/X in terminal sessions. Command-C without a selection does not interrupt a running shell command.
• Read Finder file URLs and clipboard change counts, preserve Unicode paths, and avoid stale file-paste selections. Restrict exported private keys to owner-only access.
• Build architecture-specific .app/DMG packages and validate update checksums. Add Apple Silicon/Intel macOS and Windows CI coverage.
• Fix narrow/Retina Settings layouts and a real-server SSH shutdown hang found during QA.
• Document the feature mapping, manual release matrix, actual QA results and future macOS portability rules in CLAUDE.md.

The first commit isolates stable-rustfmt normalization of existing code; functional changes follow separately.

Validation

Executed locally on Apple Silicon macOS, with x86_64 test binaries also run under Rosetta:

• 364 library tests passed per architecture (8 optional benchmarks/screenshots ignored).
• Per architecture: 2 local PTY, 2 bash/zsh integration, 9 real OpenSSH/SFTP network and 2 rendered UI flow/layout tests passed. The additional E2E benchmark returns early without its opt-in flag and is not counted as performance coverage.
• Native Keychain CRUD passed on Apple Silicon. cargo fmt --check and strict all-target Clippy passed.
• Reviewed representative UI images from 35 screenshots per architecture, including minimum-size and Retina rendering; native app smoke tests covered shortcuts, shell/PATH discovery and Command-C versus Control-C.
• Built the Apple Silicon release DMG and verified architecture, plist, strict ad-hoc signature, mountability and SHA-256.

See docs/macos-qa.md for exact commands and limits. Physical Intel hardware, macOS 11, Windows runtime, full VoiceOver/IME/Finder desktop interactions and a live installed upgrade still require the documented release matrix. Remote CI is configured but was not part of the local results. The test DMG is ad-hoc signed; Developer ID signing and notarization remain release work.