Build secure macOS signing and notarization pipeline

[blackforestboi]

Summary

• scaffold Swift 6 CLI and daemon products for universal macOS builds
• add Developer ID Application and Installer signing, hardened runtime, secure timestamps, notarytool, stapling, Gatekeeper verification, checksums, SPDX SBOMs, and GitHub provenance attestations
• add protected release-environment documentation and validation workflow

Contributes to #9 (R14-R15). The release switch remains disabled until U0 and Apple credentials are complete.

Validation

• git diff --cached --check
• plutil -lint packaging/io.worldbrain.handoffs.plist
• Bash syntax validation for every release script
• YAML parsing for workflows and Dependabot configuration
• swift package dump-package
• swift build
• universal release build verified as x86_64 arm64 for both binaries

A live Apple notarization submission was not made because the Installer certificate and App Store Connect API key are intentionally not stored locally or in the repository.