[needs-human] Enable Developer ID signing + notarization for the DMG

[missingbulb]

Tracking the human-only steps to make the downloaded .dmg open with no Gatekeeper warning ("Apple could not verify … is free of malware"). The code side is done in #4 — both DMG workflows (build-macos-dmg.yml for feature-branch CI and release-macos-dmg.yml for main/releases) already sign + notarize when the secrets below exist, and fall back to the ad-hoc build otherwise. Everything here needs a person with the Apple account + repo admin; none of it can be committed.

To-do

• Enroll in the Apple Developer Program ($99/yr) — https://developer.apple.com/programs/
• Create a "Developer ID Application" certificate and export it as a .p12 with a password (Keychain Access → export, or from the Developer portal). Note the signing identity string, e.g. Developer ID Application: Your Name (TEAMID).
• Create an app-specific password for your Apple ID (https://account.apple.com → Sign-In and Security) for notarytool, and note your 10-char Team ID.
• Add these 6 repository secrets (Settings → Secrets and variables → Actions):
  • MACOS_CERT_P12 — base64 of the .p12 (base64 -i cert.p12 | pbcopy)
  • MACOS_CERT_PASSWORD — the .p12 export password
  • MACOS_SIGN_IDENTITY — e.g. Developer ID Application: Your Name (TEAMID)
  • APPLE_ID — Apple ID email
  • APPLE_TEAM_ID — 10-char Team ID
  • APPLE_APP_PASSWORD — the app-specific password
• Trigger a build (push a change under mac/**, or run the workflow from the Actions tab) and confirm the Detect signing secrets step reports enabled=true, the Import Developer ID certificate and Notarize .dmg steps run, and stapling succeeds.
• Verify on a clean macOS 15 (Sequoia) machine: download the published LaughCounter.dmg from the latest Release and confirm it opens with no Gatekeeper warning (no need for the "Open Anyway" / xattr workaround).
• Verify runtime under the Hardened Runtime: microphone capture and the "I just laughed" speech command still work in the signed build (the entitlements in mac/Resources/LaughCounter.entitlements grant mic access; speech is TCC-gated). This is the most likely first-attempt snag.

Notes

• Until the secrets exist, CI keeps producing an ad-hoc DMG and users clear Gatekeeper manually (documented in mac/README.md → Install). Nothing here blocks CI.
• Distribute LaughCounter via Homebrew Cask (own tap) #174 (Homebrew Cask distribution) is blocked on this issue. Homebrew 5.0.0 deprecated the --no-quarantine bypass and disables Gatekeeper-failing casks from 1 Sept 2026, so brew install --cask laughcounter only becomes possible once the DMG here is signed + notarized.
• This is the non–App Store track. Shipping to the Mac App Store is a separate effort (App Sandbox + an Apple Distribution certificate + App Review) and is intentionally out of scope.
• Local one-off signing/notarizing without CI is possible too — see mac/README.md → Build it yourself.

Refs: #4. Blocks: #174.