Strip AppleDouble sidecars before auditing a sealed wheelhouse

macOS archive metadata can reappear on Linux as AppleDouble files whose names look like wheels and cause static wheel audits to parse non-ZIP bytes. After verifying the sealed archive hash, remove only regular files named ._* inside the extracted, hash-bound runtime directory, then run an exact locked wheel-set and dependency-closure audit. Do not generalize the deletion to arbitrary archives: verify the immutable archive contains no legitimate members with those names, and let the subsequent lock audit fail closed if any required wheel is absent.

Applies when: moving an offline Python wheelhouse from macOS to a Linux training host. Keywords: AppleDouble wheelhouse zip audit macOS Linux offline install