Add Nexus Shell as a macOS Fleet-maintained app

[allenhouchins]

Related issue: NA — adds a new Fleet-maintained app

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

Testing

• QA'd all new/changed functionality manually

Details

Adds Nexus Shell (native macOS SSH client, https://nexusshell.app/) as a macOS Fleet-maintained app.

Custom-tap pattern

Nexus Shell is not in homebrew/cask — the vendor distributes through their own tap (viewer12/tap). This PR follows the established custom-tap pattern (same as xcreds, zoom-rooms, druva-insync):

• ee/maintained-apps/inputs/homebrew/custom-tap/Casks/nexus-shell.rb — cask DSL (mirrors the vendor's tap cask)
• ee/maintained-apps/inputs/homebrew/custom-tap/api/nexus-shell.json — generated with regenerate.sh on macOS
• ee/maintained-apps/inputs/homebrew/nexus-shell.json — input manifest pointing at the local cask JSON via cask_path
• ee/maintained-apps/outputs/nexus-shell/darwin.json + apps.json entry — generated with go run cmd/maintained-apps/main.go --slug="nexus-shell/darwin"
• Icon generated from the app bundle via tools/software/icons/generate-icons.sh

Identity verification (against the real installer, not catalog metadata)

Downloaded Nexus-Shell-v1.6.9.dmg and inspected the bundle:

• SHA-256 matches both the vendor tap and the vendor's https://nexusshell.app/releases/latest.json
• CFBundleIdentifier = sameral.Nexus-Shell (unusual non-reverse-DNS id, but confirmed via Info.plist and codesign) → used as unique_identifier
• CFBundleShortVersionString = 1.6.9, equal to the cask version, so the patched query reconciles with osquery inventory
• Developer ID–signed: JUAN XIAO, team 5MBFAB57U2; notarized drag-install DMG

Reviewer notes

• arm64-only, macOS 14.2+ — the cask declares depends_on arch: :arm64 and depends_on macos: :sonoma; Intel Macs can't install this app.
• Pinned installer URL — the download URL is version-pinned (.../Nexus-Shell-v1.6.9.dmg), so no latest-redirect SHA drift risk.
• New/small vendor — single-developer app; vendor publishes SHA-256 in a latest.json feed, which the cask's livecheck uses.
• Custom-tap bump routine — the daily routine that bumps custom-tap casks enumerates apps; it needs nexus-shell added after this merges (version discovery: https://nexusshell.app/releases/latest.json).
• The cask's zap paths intentionally cover only the Developer ID build; the separate Mac App Store variant is left untouched.

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 68.53%. Comparing base (bc537a3) to head (b867188).

Files with missing lines	Patch %	Lines
...pages/SoftwarePage/components/icons/NexusShell.tsx	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #50824      +/-   ##
==========================================
- Coverage   68.53%   68.53%   -0.01%     
==========================================
  Files        3977     3978       +1     
  Lines      256168   256170       +2     
  Branches    13818    13818              
==========================================
+ Hits       175566   175567       +1     
- Misses      64982    64983       +1     
  Partials    15620    15620              

Flag	Coverage Δ
frontend	62.71% <50.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.