fix(desktop): sign and notarize macOS installer

[AbdurrehmanSubhani]

Summary

• macOS desktop release builds are now code-signed and notarized, so the DMG installs and launches on clean Macs without Gatekeeper warnings.
• Signing covers the app, the bundled uv sidecar, and the inner executable under the hardened runtime; the notarization ticket is stapled.
• Signing is release-only — pull request, push, and fork builds stay unsigned and require no Apple secrets.

Validation

• Local end-to-end signed build against the real Developer ID cert + App Store Connect API key: tauri build → Notarizing Finished with status Accepted → app stapled.
• codesign -d --entitlements - on the bundled uv — confirms hardened-runtime entitlements propagate to the sidecar.
• Launched the signed app; uv sidecar spawns under hardened runtime with no signature/dyld/library-validation errors.
• node --check on build-desktop.mjs; YAML/JSON parse of changed workflows and tauri.conf.json.

Changelog

• Added changes/macos-release-signing.feature.md
• This is dependency maintenance, or it is internal-only and the PR explains why a maintainer should apply skip-changelog:

BEGIN_COMMIT_OVERRIDE
fix(desktop): provide a signed and notarized macOS installer
END_COMMIT_OVERRIDE