v0.4.1

• Publish the signed macOS DMGs as draftomen-vX.Y.Z-macos-arm64.dmg and
  draftomen-vX.Y.Z-macos-x86_64.dmg, and the checksum file as
  draftomen-vX.Y.Z-sha256sums.txt. The Windows executable keeps its
  unsigned name. The website download buttons, the README and the release
  docs use the new names. The README covers installing, Gatekeeper and
  notarization troubleshooting, and uninstalling, and docs/releasing.md
  adds a post-release check that opens a browser-downloaded DMG on a Mac that
  has never run Draft Omen. (#730)
• Sign, notarize and staple the macOS DMGs in tag releases. release.yml
  calls native-bundles.yml with sign_macos: true, and only the macOS jobs
  of that call use the macos-release environment. Each job builds with
  Nuitka's Developer ID signing, copies the verified app to Draft Omen.app
  with ditto so the data-file signatures survive, signs and notarizes the
  DMG, and runs the smoke test on the app inside the stapled DMG. An
  always-run step deletes the temporary keychain and credential files.
  The mounted smoke test now retries a busy hdiutil detach before forcing
  it. Development builds stay unsigned. The release asset names still say
  unsigned until #730 renames them. (#729)
• Document the macOS signing credentials in docs/releasing.md: the
  Developer ID Application certificate, the App Store Connect Team API key,
  the protected macos-release environment that only v* tags can use, the
  secret and variable names, and how to rotate or revoke each credential.
  (#728)
• Stop publishing Draft Omen to PyPI and Homebrew. A tagged release now only
  builds the native macOS and Windows bundles and attaches them to the GitHub
  Release. The release workflow drops the wheel build, the wheel smoke tests,
  the PyPI publish job, and the Homebrew job. homebrew.yml, the formula
  template, scripts/render_homebrew_formula.py, and tests/package_smoke.py
  are removed. Version 0.4.0 stays on PyPI and in the Homebrew tap but gets no
  further updates. The README now points to the GitHub Release downloads.
• Fix the Homebrew formula build. bidict, a dependency of
  python-socketio, builds with uv_build, which Homebrew compiles from
  source with Rust. The formula now declares rust as a build dependency.