[aidan] fix/spotify-drm: VMP-sign packaged builds so Widevine playback works

scripts/build-app-win.ps1

@@ -70,6 +70,10 @@ if ($Sign) {
         Write-Host "Copy .env.windows.example to .env.windows and fill in values."
         exit 1
     }
+    # A signed build is one users actually run, so its Widevine VMP signature is
+    # mandatory: the afterPack hook hard-fails on a missing/failed signature rather
+    # than ship an installer whose Spotify/Netflix audio is silently dead.
+    $env:VMP_REQUIRE_SIGN = '1'
 }
 
 # --- Step 0: Bundled uv + uvx for Windows ---

scripts/build-app.sh

@@ -66,6 +66,10 @@ if $SIGN_MODE; then
         echo "See script header for details."
         exit 1
     fi
+    # A signed build is a build users actually run, so its Widevine VMP signature
+    # is mandatory: the afterPack hook hard-fails on a missing/failed signature
+    # instead of shipping a DMG whose Spotify/Netflix audio is silently dead.
+    export VMP_REQUIRE_SIGN=1
 fi
 
 # Step 0: Ensure bundled uv + uvx binaries exist.