ci(macos): sign and notarize releases

[Mathious6]

What changed

• import the Developer ID certificate with the official Apple GitHub Action
• sign and notarize the macOS app during the Tauri build
• notarize, staple, and verify both architecture-specific DMGs before publication
• keep the release in draft when Apple or updater validation fails
• document the Apple release secrets and notarized installation flow

Validation

• bun run check
• bun run build
• cargo fmt --all --manifest-path src-tauri/Cargo.toml -- --check
• cargo clippy --locked --all-targets --manifest-path src-tauri/Cargo.toml -- -D warnings
• cargo test --locked --lib --manifest-path src-tauri/Cargo.toml
• Oracle pre-commit review: no findings

The live Apple notarization path will be exercised by the first v0.3.2 tag after merge.