v0.6.0-phase5 — branding + installers

Phase 5: branding and packaging.

• Branding: SVG master icon + generate_icons.sh (.icns/.ico/PNG). User-agent policy: left identical to Chrome — no unique token — for fingerprinting resistance (achieved by deliberately not patching the UA).
• macOS: build.sh, create_dmg.sh (ad-hoc signing for dev; Developer ID + notarytool/stapler for release), hardened-runtime entitlements, SIGNING.md, reproducible-build notes.
• Windows: build.ps1, NSIS installer.nsi, SIGNING.md.
• Compiling and signing real artifacts needs a build host (see BUILDING.md).