fix(frontend): harden result lifecycle and macOS distribution

[openai0229]

Summary

• pin the complete Community VTable lifecycle cleanup and regression coverage
• package macOS with Developer ID, hardened runtime, Apple notarization, and stapled ZIP/DMG verification
• gate signing to an approved exact SHA on protected main through the macos-release Environment
• verify every bundled Java Mach-O signature before artifact upload

Validation

• exact-SHA white-screen package run 30924178187 passed at c3b21e0
• shellcheck and bash syntax checks passed for all packaging scripts
• actionlint, JSON validation, git diff check, and gitleaks passed
• two independent packaging reviews report no remaining P0/P1 blocker

The Developer ID/notarization path intentionally runs only after merge from protected main.