fix: harden macOS release packaging

[amirbrooks]

Summary

• make immutable Git-staged bundle resources writable before metadata removal and signing
• ad-hoc sign stripped Swift executables before canonical native-license inventory
• select the current 64-bit-inode statfs ABI for Intel macOS local-volume validation
• add regression coverage and durable release guidance

Validation

• Ruff check and format: passed
• Python unit suite: 261 passed, 1 skipped
• Swift debug/release tests: 112 passed in each configuration
• Swift release build and swift-format: passed
• fresh hash-locked install, pip check, and CLI help surfaces: passed
• source-bound sdist/wheel verification and privacy scan: passed
• signed packaged-helper smoke: passed on arm64 and x86_64
• arm64 and x86_64 apps/DMGs: Developer ID signed, notarized, stapled, Gatekeeper accepted, architecture/license/manifest/privacy gates passed

No release tag or artifact upload is included.