macOS: sign and notarize the release build (Developer ID)

[Turbootzz]

The macOS release artifacts ship unsigned (no Apple Developer Program membership yet). Two consequences for users:

1. Gatekeeper: the first launch needs right-click → Open, since a plain double-click offers no way past the quarantine warning.
2. Permissions reset on update: TCC keys the Screen Recording grant to the code-signing identity. An unsigned/ad-hoc build gets a fresh identity on every build, so macOS treats an update as a different app and asks for the permission again. On macOS 26 an unsigned app also does not appear in the Screen Recording privacy pane at all.

Both go away with a Developer ID Application certificate ($99/yr Apple Developer Program):

• vpk pack --signAppIdentity "Developer ID Application: ..." --signInstallIdentity "Developer ID Installer: ..." --notaryProfile <profile> in the macos-pack job (the flags are already documented in a comment there).
• Certificate + notarytool credentials as repository secrets, imported into a temporary keychain in CI.
• A hardened-runtime entitlements file (--signEntitlements) — the recorder needs microphone access (com.apple.security.device.audio-input); screen capture is TCC-only and needs no entitlement.

Blocked on buying the membership; the Windows SignPath Foundation application (#137) has its own bar (OSS popularity), so both platforms stay unsigned for the coming releases.