feat(ci): sign and notarize macOS binaries on Linux with rcodesign

[philprime]

Summary

• Replaces the self-hosted macOS runner for signing/notarization with a Linux k8s runner using the kula/rcodesign:alpine container.
• Signing uses rcodesign with --code-signature-flags runtime (hardened runtime). The Developer ID cert is supplied directly from the .p12, so no keychain setup is needed.
• Notarization uses rcodesign notary-submit --wait with an App Store Connect API key JSON blob assembled at runtime via rcodesign encode-app-store-connect-api-key — replaces the Apple ID + app-specific password approach.
• Removes the setup-macos-signing and cleanup-macos-signing composite actions (no longer needed).
• Updates docs/MACOS_SIGNING.md to reflect the new flow.

Why

• Removes the dependency on a self-hosted macOS runner (operational cost, fleet maintenance, single point of failure).
• Collapses the keychain import dance into a 3-line signing step that runs inside a deterministic container image.
• rcodesign is a strong fit here because we only sign standalone Mach-O binaries — none of rcodesign's known gaps around bundles, DMGs, or .pkg installers apply.

Org-level secrets/variables

All required secrets and variables are already provisioned at the kula-app org level — no setup required:

Secrets (existing): DEVELOPER_ID_P12_BASE64, DEVELOPER_ID_PASSWORD, APPLE_NOTARIZATION_APP_STORE_CONNECT_API_KEY_P8_BASE64

Variables (existing): APPLE_NOTARIZATION_APP_STORE_CONNECT_API_KEY_ID, APPLE_NOTARIZATION_APP_STORE_CONNECT_API_ISSUER_ID

The legacy Apple-ID secrets/vars (APPLE_NOTARIZATION_APPLE_ID_PASSWORD, APPLE_NOTARIZATION_APPLE_ID_USERNAME, APPLE_NOTARIZATION_TEAM_ID, APPLE_NOTARIZATION_SIGNING_IDENTITY) can be removed from the org once every repo using them has migrated.

Caveats

• rcodesign signatures can have minor byte-level differences vs. Apple's codesign (segment flag / CodeRequirements encoding). They verify fine, but it is worth downloading a signed build from CI and running codesign -dvv + spctl -a -vv -t install on a real Mac before treating this as the canonical flow.

Test plan

• Trigger the release workflow from this branch and verify signing job runs to completion.
• Download the resulting darwin-arm64 artifact and verify on a Mac:
  • codesign -dvv <binary> → Authority chain shows Developer ID Application + Developer ID CA + Apple Root CA, flags include runtime, Timestamp present.
  • spctl -a -vv -t install <binary> → accepted, source=Notarized Developer ID.
  • ./<binary> --version runs without Gatekeeper warning.