[packaging] Bump the bundle to 0.1.3

Ships the corrected wedge diagnostic, and is the first release cut by the
workflow rather than by hand.

Solves: release vehicle for #27
Tests: release workflow asserts the tag matches this value before signing

Author: drycode

swift/Packaging/Info.plist

@@ -2,66 +2,30 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>CFBundleExecutable</key>
+	<string>tacet</string>
 	<key>CFBundleIdentifier</key>
 	<string>com.drycodeworks.tacet-agent</string>
 	<key>CFBundleName</key>
 	<string>Tacet</string>
-	<key>CFBundleExecutable</key>
-	<string>tacet</string>
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>0.1.2</string>
+	<string>0.1.3</string>
 	<key>CFBundleVersion</key>
-	<string>3</string>
+	<string>4</string>
 	<key>LSMinimumSystemVersion</key>
 	<string>13.0</string>
 	<key>LSUIElement</key>
 	<true/>
-	<key>NSMicrophoneUsageDescription</key>
-	<string>Tacet records your voice while you hold the dictate hotkey, to transcribe it.</string>
-	<key>NSLocalNetworkUsageDescription</key>
-	<string>Tacet talks to the transcription server on your local network.</string>
-	<!-- ATS cannot express this app's actual policy, so the app enforces its
-	     own and ATS is opened to let it.
-
-	     NSAllowsLocalNetworking alone was not enough: it covers .local names
-	     and link-local addresses, and a Tailscale peer is neither — the
-	     tailnet uses CGNAT space (100.64.0.0/10). The two-machine setup
-	     therefore failed with:
-
-	       Cannot start load of Task ... since it does not conform to ATS policy
-	       finished with error [-1022] ... requires the use of a secure connection
-
-	     while the SAME build worked on the machine running the server,
-	     because there the tailnet address belongs to the local host and
-	     CFNetwork treats it as local. So this is invisible to a
-	     single-machine install and to every test.
-
-	     The exceptions ATS does support are static domain lists, and the
-	     server address here is user configuration — there is nothing to
-	     enumerate at build time.
-
-	     What actually gates connections is ClientConfig.validateTransport,
-	     which is stricter than ATS where it matters: plain HTTP to loopback
-	     always, to a numeric IP only with an explicit opt-in recorded in the
-	     config, and to a HOSTNAME never — where ATS would happily allow a
-	     hostname it considers "local".
-
-	     REMOVE THIS once the server speaks TLS. A tailnet with HTTPS enabled
-	     can issue a real certificate for its MagicDNS name (`tailscale cert`),
-	     and an https:// hostname needs no exception at all. -->
 	<key>NSAppTransportSecurity</key>
 	<dict>
-		<!-- ONLY this key. Do not add NSAllowsLocalNetworking back.
-		     Apple: if NSAllowsLocalNetworking is present, the system IGNORES
-		     NSAllowsArbitraryLoads on macOS 10.12+. The two together are not
-		     additive — the more specific key wins and the general one is
-		     silently discarded, which is how a bundle can carry
-		     NSAllowsArbitraryLoads=true and still fail every request with
-		     -1022. Verified exactly that way here. -->
 		<key>NSAllowsArbitraryLoads</key>
 		<true/>
 	</dict>
+	<key>NSLocalNetworkUsageDescription</key>
+	<string>Tacet talks to the transcription server on your local network.</string>
+	<key>NSMicrophoneUsageDescription</key>
+	<string>Tacet records your voice while you hold the dictate hotkey, to transcribe it.</string>
 </dict>
 </plist>