Add ENABLE_HARDENED_RUNTIME=YES to project settings and re-sign the
extracted app with --timestamp --options runtime before notarizing.
Both are required by Apple's notarization service.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>