[hanneshapke]

Summary

• Bumps electron-builder from ^26.15.3 to ^26.18.1 in src/frontend (lockfile updated).
• Picks up the macOS code-signing fix that was missing from 26.16.0 (Merged macOS keychain password fix missing from electron-builder 26.16.0 electron-userland/electron-builder#10167, shipped in 26.16.1): security set-key-partition-list was called with the .p12 import password instead of the temporary keychain password, so CSC_LINK signing in CI failed with SecKeychainUnlock: The user name or passphrase you entered is not correct.
• Re-enables the macOS DMG build and Homebrew cask publishing in release.yml by reverting ci: temporarily disable DMG build and Homebrew tap in release #657: restores the build-dmg and publish-homebrew-tap jobs, puts build-dmg back in create-release's needs, and restores the macOS release notes.
• Adds patch changesets for both changes.

The lockfile diff is mostly electron-builder's own dependencies being reshuffled (fs-extra/jsonfile/universalify dedupe). There is still a single react@19.

Test plan

• npx electron-builder --version reports 26.18.1
• release.yml parses; jobs and create-release.needs include build-dmg
• Signed DMG build succeeds on the next release run (_build-dmg.yml)
• Homebrew cask publishes for the next stable release

🤖 Generated with Claude Code

[github-actions]

Warning

This PR touches 3+ distinct areas of the codebase.

Consider splitting into smaller, focused PRs — each covering a single semantic type.
This makes reviews easier and keeps the git history clean.

Categories found:

docs:

• .changeset/bump-electron-builder.md
• .changeset/reenable-dmg-release.md

chore:

• package-lock.json
• src/frontend/package.json

ci:

• .github/workflows/release.yml