feat(desktop): code-signing automation (macOS notarize / Windows signtool)

[rickylabs]

Part of #327

Handle: #E8 · Milestone: 0.0.1-stable · Depends on: #E6.

Scope — code-signing automation (macOS notarize / Windows signtool)

Automate macOS Developer-ID + notarytool and Windows signtool as build steps (external credentials/tooling; deno desktop does not wrap them). D4: manual for v1, automate at stable.

Acceptance

• Signed+notarized artifacts produced in CI with documented credential handling; no secrets in logs.

Design source: design/E-desktop/epic-and-issues.md (#E8).

[rickylabs]

Dependency edge (DAG second pass): Depends on #456 (E6).