Release CrawlBar v0.4.1 with trusted macOS artifacts

[steipete]

Summary

• accept current crawlkit/control manifests when optional description or branding fields are omitted
• require exact OpenClaw Foundation Developer ID signing for official releases while keeping local and CI packages credential-free
• build universal, hardened, notarized, stapled app-only release archives and verify exact tag ancestry, signature, assets, bundle identity, and archive layout

Proof

• swift build
• swift run crawlbar-selftest
• CLI and packaged CLI smoke
• local credential-free package and fail-closed official-package negative test
• Foundation codesign, universal architectures, hardened runtime
• notarization accepted; stapler, Gatekeeper, and syspolicy_check distribution pass
• hostile ZIP sibling and symlink probes rejected
• shellcheck, actionlint, git diff --check
• source-blind behavior contract passes
• autoreview clean; no findings

Homebrew remains a release blocker until the canonical Formula installs the byte-identical signed v0.4.1 artifact.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: Release CrawlBar v0.4.1 with trusted macOS artifacts This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.