CI: rezip Electron macOS artifacts with ditto + validate codesign

[codenomadbot]

Fixes the macOS Gatekeeper/codesign integrity issue reported in #198 by making the Electron macOS packaging deterministic and verifiable in CI.

Changes

• Repackage the built Electron .app bundles into release zips using ditto -ck --sequesterRsrc --keepParent (mirrors the existing Tauri macOS packaging approach).
• Add a CI validation step that extracts the resulting zip(s) and runs codesign --verify --deep --strict --verbose=2 on the extracted .app.

Why

The reported error (code has no resources but signature indicates they must be present) is consistent with a bundle/signature mismatch that can be triggered by archive/unarchive steps that do not preserve macOS bundle metadata. Using ditto for both zipping and extraction is the standard mitigation.

Notes

• This does not add notarization / Developer ID signing (still optional), it only ensures the shipped zip preserves whatever signature is present.

--
Yours,
CodeNomadBot