ci(release): pre-import Apple cert before sidecar build

[mrdulasolutions]

Summary

Notarization rejected v0.1.8 with [Apple log](attached error) flagging exactly one file:

```json
{
"path": ".../runtime-modules/better-sqlite3/build/Release/better_sqlite3.node",
"message": "The binary is not signed with a valid Developer ID certificate."
},
{
"path": ".../runtime-modules/better-sqlite3/build/Release/better_sqlite3.node",
"message": "The signature does not include a secure timestamp."
}
```

That's the file `copy-runtime-modules.mjs` is supposed to sign — but my PR #7 patch made it best-effort, so when the runner's keychain didn't have the cert (which it doesn't, because tauri-action imports the cert later), the script logged a warning and kept going. Tauri-bundler's own codesign pass only walks `Contents/MacOS/`, never `Resources/`, so the .node stayed unsigned.

Fix

Add a new step right before "Build sidecar" that mirrors tauri-action's keychain dance but against the runner's default `login.keychain-db`:

1. Decode `APPLE_CERTIFICATE` (base64 .p12) to a tmp file.
2. `security import` it into `login.keychain-db` with `-T /usr/bin/codesign` so codesign can use it non-interactively.
3. `security set-key-partition-list` to grant codesign access without a GUI prompt.
4. `security find-identity -v -p codesigning` for visibility — should show "Developer ID Application: Matthew Dula (PPY9K2BYJH)".

Skips with an explanatory log when the secrets aren't set (unsigned-build path stays functional).

When tauri-action runs later it still creates its own keychain and imports the same cert there — codesign finds the identity in either, no conflict.

Test plan

• CI green on this PR
• After merge: dispatch v0.1.8 release one more time
• arm64 build runs through: pre-import → sidecar build (now successfully signs .node with timestamp) → tauri-action codesign → notarytool accepts → AppleDouble gate passes
• Draft release contains signed + notarized .dmg, .app.tar.gz, .sig, latest.json for both architectures
• Locally verify with `codesign --verify --verbose=4` and `stapler validate`

🤖 Generated with Claude Code