Prepare signed macOS release path

[FernandoAbishai]

Problem

The repository exposed release:trust:signed, but that check loaded the ad-hoc candidate config. There was no concrete Developer ID/Hardened Runtime/notarization packaging path, and no verifier that proved Apple trust on the exact signed app.

Change

• add a separate electron-builder.signed.cjs for Developer ID distribution signing, Hardened Runtime, minimal Electron JIT entitlements, and electron-builder notarization
• add release:signed:arm64, which hard-fails on missing credentials before clearing/building anything
• keep the existing public ad-hoc alpha config/workflow unchanged
• rebuild the self-contained artifact with publishing explicitly disabled and rerun packaged runtime, identity, FFmpeg, backend, renderer, creator, optional-capability, and transcription gates against the exact signed app
• verify strict code signing, Developer ID authority/team, Hardened Runtime, Gatekeeper acceptance, and the app notarization staple; verify the DMG container separately with hdiutil
• support API-key, Apple-ID, or keychain-profile notarization credentials and certificate-file/keychain signing inputs

Verification

• signed config static contract: PASS
• primary/inherited entitlements plutil -lint: PASS
• unsigned candidate trust check: PASS and unchanged
• public release/workflow smokes: PASS
• git diff --check: PASS
• no-credential release:signed:arm64: correctly FAILS before artifact mutation with Developer ID credentials configured: No and Notary credentials configured: No
• existing ad-hoc app is correctly rejected by the signed-artifact verifier

Current limitation

A real signed artifact cannot be produced on this machine because there is no valid Developer ID Application identity and no notarization credentials. This PR prepares and verifies the credentialed path; it does not claim that Apple signing/notarization has already succeeded.

The DMG container is integrity-checked but is not described as independently signed/notarized. The Apple trust claims apply to ScriptCut.app inside it, matching electron-builder 26.15.3 behavior.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.