fix(native): remove completed signing capture limitation (#5548)

* fix(native): remove completed signing capture limitation

* fix(cli): keep the WASM command timeout optional

* fix(cli): preserve WASM timeout help metadata

* test(pe): reuse compiled CLI startup for resource acceptance

* fix(cli): use upstream exact-optional timeout semantics

src/native/parsers/codesign.ts

@@ -45,11 +45,7 @@ export const parseCodeSignature = (
     entitlements: null,
     timestamp: values.get("Timestamp") ?? null,
     hardened_runtime: parseRuntime(values.get("CodeDirectory")),
-    limitations: unsigned
-      ? ["Artifact is not signed."]
-      : [
-          "Entitlements and designated requirements require separate bounded commands.",
-        ],
+    limitations: unsigned ? ["Artifact is not signed."] : [],
   });
   return parsed;
 };

tests/boundary/cli/nativeSignatureCli.test.ts

@@ -60,7 +60,13 @@ describe.skipIf(process.platform !== "darwin")(
               authorities: [],
               entitlements: null,
               designated_requirement: expect.stringMatching(/^cdhash H"/u),
+              limitations: [
+                expect.stringContaining("trust validation are not examined."),
+              ],
             },
+            limitations: [
+              expect.stringContaining("trust validation are not examined."),
+            ],
           });
         }
         const identifier = await cli.run({

tests/boundary/providers/native/nativeSignatureTargetBinding.test.ts

@@ -73,6 +73,10 @@ describe("native signature target identity", () => {
     expect(result.value.result).toMatchObject({
       signed: true,
       identifier: "com.example.fixture",
+      designated_requirement: "identifier com.example.fixture",
+      limitations: [
+        "Inspected a digest-verified Mach-O byte snapshot; filesystem-bound signing context and trust validation are not examined.",
+      ],
     });
   });