Add production macOS signing and notarized releases

[enaboapps]

Summary

Add Apple Silicon Developer ID signing, notarization, stapling, verification, and GitHub Release publishing for the Tauri app while preserving the local Switchify PC Development identity for Accessibility testing.

Requirements

• Use a GitHub-hosted macOS runner and ephemeral keychain.
• Trigger for v* tags and manual tag input, matching the retained Windows release contract.
• Verify tag/version consistency before publishing.
• Sign all nested app code with the Developer ID Application identity.
• Notarize and staple the app and DMG, then validate codesign, Gatekeeper, architecture, and tickets.
• Create or update the matching GitHub Release without modifying legacy C# releases.
• Keep pull-request/main CI unsigned and keep updater configuration out of scope.
• Document certificate/API-key setup, secret names, release procedure, rotation, and troubleshooting.

Acceptance criteria

• An authorized v* tag can produce a verified, notarized Apple Silicon DMG.
• No Apple credential is stored in Git or printed in logs.
• Local npm run macos:run continues using Switchify PC Development.
• Node/Rust checks and unsigned CI remain green.