Fix macOS DMG bundle signing

[hrhrng]

What changed

• opt macOS packaging into complete ad-hoc bundle signing (identity: "-")
• disable hardened runtime for the ad-hoc distribution so Electron frameworks can load normally
• verify the mounted app bundle with strict codesign checks before uploading any workflow artifact or GitHub Release asset
• run the packaged first-prompt smoke before publication and target the cold new-chat composer correctly

Root cause

The published DMG itself had a valid checksum, but the app inside was not a valid signed bundle. Electron Mach-O files retained linker-generated ad-hoc signatures while the app had no _CodeSignature/CodeResources resource seal. codesign --verify --deep --strict failed with code has no resources but signature indicates they must be present, which macOS surfaces as a damaged app.

Impact

New DMGs contain a structurally valid ad-hoc signed app instead of a malformed partially signed bundle. This removes the damaged-package failure without requiring an Apple Developer certificate. The build remains unnotarized, so macOS may still show the normal unidentified-developer warning.

Validation

• reproduced the failure against the exact v0.0.3 Release asset; GitHub SHA-256 and hdiutil verify both confirmed the DMG transport was intact
• built a new arm64 DMG and verified its checksum
• mounted the final DMG and passed codesign --verify --deep --strict --verbose=4
• passed packaged runtime import verification
• launched directly from the mounted DMG and passed the packaged first-prompt smoke
• pnpm run typecheck
• pnpm run test:ci (148 tests)
• node --test scripts/*.test.mjs (26 tests)