Lane 15: Ship signed and notarized BearBrowser macOS app distribution

[mdheller]

Create the real macOS GUI app distribution path for BearBrowser.

Scope:

• Produce BearBrowser.app with BearBrowser name, app id, icon, bundle metadata, and product assets.
• Ensure the app does not expose upstream LibreWolf branding in app name, dock, menus, about dialog, desktop/app metadata, profile naming, or icons.
• Sign and notarize the macOS app so it passes Gatekeeper.
• Publish a DMG release artifact.
• Update packaging/homebrew/Casks/bearbrowser.rb to point to the signed/notarized DMG with a real SHA256.
• Validate brew install --cask SourceOS-Linux/tap/bearbrowser.

Acceptance criteria:

• BearBrowser.app opens without Gatekeeper failure.
• Homebrew Cask install works.
• App bundle metadata says BearBrowser.
• Icon/logo is BearBrowser.
• Upstream attribution remains in legal/provenance surfaces only.
• Release artifact metadata includes upstream ref, BearBrowser revision, signing identity, notarization status, and artifact hash.

[mdheller]

Progress update on main:

Completed:

• Added packaging/macos/README.md.
• Added packaging/macos/Info.plist.template.
• Added packaging/macos/entitlements.plist.
• Added scripts/prepare-macos-app-bundle.sh.
• Added scripts/package-macos-app.sh.
• Added scripts/sign-notarize-macos-app.sh.
• Added scripts/verify-macos-app.sh.
• Added scripts/update-homebrew-cask.sh.
• Added .github/workflows/macos-distribution.yml.

Current status:

• macOS app identity, signing, notarization, DMG packaging, Cask SHA update, and validation gates are codified.
• Scripts fail closed until a real BearBrowser.app exists and Apple signing/notarization credentials are configured.

Still open:

• Lane 13 must produce a real app bundle/browser binary.
• Apple Developer signing identity and notarytool profile must be configured.
• A signed/notarized DMG must be published.
• Cask must be updated with a real SHA256 and tested with brew install --cask SourceOS-Linux/tap/bearbrowser.