macOS: Developer ID signing and notarization #316

Part of #311 (Group C, security hardening). Owner: not assigned. Task base and PR target: develop. Needs a decision from Anders first.

Intended behavior

The macOS Runtime binary carries a Developer ID signature and a notarization ticket. Gatekeeper accepts it however the user obtains it, and its signature identifies the publisher.

Current behavior

• No step in release-package.yml, scripts/prepare-release-platform.sh or scripts/package-release-binaries.sh runs codesign or notarytool. The binary has only the linker's ad-hoc signature.
• Installs through curl … | bash work because curl sets no quarantine flag. A binary downloaded through a browser, for example from a GitHub Release, is blocked by Gatekeeper.

Constraints

• Signing keys stay off CI runners and agents, the same as the release key (Replace the maintainer release key and keep signing off the public server #186). Sign in the operator signing step.
• codesign changes the binary bytes. The signed release must hash the signed bytes: artifact SHA-256 and CID in the release, and the installer check. Run codesign before release-signer.py computes hashes.

Done means

• Anders records the decision (Apple Developer account, who holds the key). If he declines, close this issue with that reason.
• If accepted: the released Mac binary passes codesign --verify --strict --verbose=2 and spctl -a -t exec -vv on a clean Mac. The signed release hashes match the notarized bytes. Proof: the release receipt and the command output.