fix(macos): bundle audio capture for launchd privacy

openspec/specs/meeting-recording/spec.md

@@ -43,6 +43,8 @@ On Windows, Meeting Assistant SHALL retain the existing NAudio microphone and WA
 
 On macOS, Meeting Assistant SHALL capture the default microphone through AVFoundation and computer output through ScreenCaptureKit without requiring a virtual audio device.
 
+The macOS native audio helper SHALL be packaged and launched from a signed application bundle with the stable bundle identifier `cloud.schweigert.meeting-assistant.audio-capture` and a microphone usage description so macOS privacy grants apply to background LaunchAgent capture and persist across deployments.
+
 The macOS capture adapter SHALL convert both native sources to signed 16-bit PCM using the active run's configured sample rate and channel count before passing chunks to the existing managed mixing pipeline.
 
 The macOS capture adapter SHALL stop its native capture process when the recording capture token is cancelled.
@@ -154,6 +156,12 @@ When no runtime microphone override is selected, the checked microphone SHALL be
 - **AND** captures computer output through ScreenCaptureKit
 - **AND** passes both signed 16-bit PCM streams through the existing mixer
 
+#### Scenario: macOS background capture uses a stable privacy identity
+- **GIVEN** Meeting Assistant runs as a macOS LaunchAgent
+- **WHEN** it starts the native audio helper
+- **THEN** it launches the executable from the signed Meeting Assistant audio-capture application bundle
+- **AND** macOS evaluates Microphone and Screen Recording/System Audio access against the bundle identifier `cloud.schweigert.meeting-assistant.audio-capture`
+
 #### Scenario: macOS capture uses run audio format
 - **GIVEN** an active macOS recording configures a sample rate and channel count
 - **WHEN** the native capture helpers start