Thanks for the detailed report and the codesign verification steps. This is a confirmed bug - we were able to reproduce it on our end as well. All three helper bundles (GPU, Plugin, Renderer) carry the stale com.github.Electron.helper identifier instead of matching the production bundle identifier.
This is a known issue that our team is actively working on. It stems from the signing pipeline not explicitly setting identifiers for the helper bundles. You’re right that it impacts firewall rules, MDM policies, and TCC decisions that rely on codesign identifiers. This related thread reports a downstream consequence of the same gap (repeated macOS permission prompts for MCP servers).
We’ll follow up here when a fix ships. Thank you for taking the time to report this.