The osx-sign callback returns before signing finishes, so the share extension signature raced the main app signature.
electron-builder skips PlugIns and notarizes before afterSign, so the extension kept its ad-hoc signature. Sign it with Developer ID, a timestamp, and the hardened runtime first.
A macOS share extension receives WeChat's merged-forward ZIP and saves the transcript, images, and videos as one note.