Add signed and notarized macOS release pipeline

[sdglhm]

Summary

The app can already build local .app and .dmg artifacts, and GitHub Actions can now produce them, but releases are still unsigned and unnotarized.

Goals

• make builds friendlier for real testers on macOS
• reduce Gatekeeper warnings
• move toward a real release pipeline

Scope

• document required Apple signing credentials/secrets
• add signing hooks to the GitHub build workflow
• add notarization and stapling steps for macOS builds
• validate the final signed DMG flow end to end

Acceptance Criteria

• GitHub Actions can build a signed macOS app and DMG when secrets are configured
• notarization and stapling are automated
• README documents the required secrets and release flow
• release artifacts install more cleanly on another Mac