Fix tag release packaging and unsigned macOS verification

[haaaashimi]

Root cause

The v1.3.0 release run packaged the static package.json version 1.0.0, causing electron-builder to target the existing v1.0.0 release. The matrix build also implicitly published artifacts before the dedicated publish job. On macOS, CI has no Developer ID certificate, but the workflow still ran strict signature verification against the unsigned app bundle.

Changes

• derive the packaged app version from GITHUB_REF_NAME
• pass --publish never to electron-builder build scripts so the final publish job exclusively owns publishing
• verify bundled macOS resources without strict app-signature checks when the CI build is unsigned

Validation

• confirmed the failing log reaches a successful DMG build before codesign --verify fails
• confirmed the release tag is v1.3.0 while electron-builder reports version/tag 1.0.0
• reviewed the branch diff against main

A tag-triggered release run is still required to fully validate both platform artifacts and publishing.