[codex] Fix native macOS release signing

[Aucannot]

Summary

Fix the native macOS release packaging path so GitHub release assets are generated from a complete, verifiable app bundle instead of an unsigned hand-built bundle.

Root cause

The previous native macOS release DMG contained an app bundle created by copying the Swift executable and writing Info.plist, but the bundle was never signed at the app bundle level. Gatekeeper saw an invalid resource seal (code has no resources but signature indicates they must be present) and reported the downloaded app as damaged.

Changes

• Build a complete StandForge Native.app with Contents/Resources/icon.icns.
• Sign the app bundle and verify it before packaging.
• Generate and verify the DMG from the signed bundle.
• Support release signing, DMG signing, notarization, and stapling through environment variables.
• Add a GitHub Actions workflow for tag/manual native macOS releases using Apple Developer ID secrets.
• Document local adhoc builds versus public Developer ID notarized releases.

Validation

• npm run mac:native:build
• Mounted the generated DMG and verified the embedded app with codesign --verify --deep --strict --verbose=4.
• Verified the generated DMG with hdiutil verify.
• spctl still rejects adhoc local builds as expected; release builds require Developer ID signing and notarization secrets.