[codex] prepare direct macOS release

[Zacaria]

Summary

• add a public macOS release pipeline that builds a universal bundle, signs it, validates stapled artifacts, and publishes stable GitHub Release asset names
• add a GitHub Pages landing page under site/ for the macOS download funnel
• document the direct-download release flow, required GitHub secrets, and manual fallback steps
• align existing workflows with the repository default branch (master)
• include the generated Tauri icon assets required by the updated bundle config

Why

The repository was prepared for local bundling, but not for a trustworthy public macOS release channel. This change adds the repo-side pieces needed for a GitHub Releases + GitHub Pages launch and fixes workflow drift that would have broken publishing.

Validation

• cargo check --manifest-path src-tauri/Cargo.toml
• cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
• verified GitHub Pages is enabled for Zacaria/float
• verified the required Actions secret names exist in the repository

Notes

• The Apple credentials were only validated for presence as repository secrets; the real proof will be the first notarization workflow run.
• The original working tree had unrelated local changes, so this PR was cut from a clean branch based on master to keep scope isolated.