Add GitHub macOS notarized release

[jmcte]

Summary

• Add a GitHub Actions release workflow that imports a Developer ID certificate into a temporary keychain.
• Build, sign, notarize, staple, checksum, and publish a versioned Flapline DMG.
• Document the protected prod environment secrets required for unattended Apple release signing.

Governing Issue

No linked issue. This release automation was explicitly requested by the project owner.

Validation

• bash -n scripts/ci/run-macos-notarized-release.sh
• actionlint .github/workflows/macos-notarized-release.yml
• bash scripts/ci/run-release-verification.sh
• Apple signing and notarization require the protected prod environment secrets to be configured before the workflow can run.

Bootstrap Governance

• Work is on a feature branch.
• Signing material is referenced only as protected GitHub environment secrets.
• No certificate, private key, Apple credential, or local environment file is committed.

Merge Automation

Auto-merge is not safe to enable until the release-workflow review is complete and the protected Apple signing inputs are configured.

Notes

The workflow uses an App Store Connect API key with notarytool, avoiding an Apple ID password in automation. It creates a stapled DMG and SHA-256 checksum for each exact SemVer tag or approved manual release.

[Hermes-omt]

Approved. I found no blocking issues in the new notarized macOS release workflow or release script.

Validation on Hermes/macOS: route proof confirmed Darwin on Mac.Home; PR head 5821a53 contains origin/main; live PR checks are green; bash syntax, actionlint, the repo release verification script, and a signing-disabled Release Xcode build all passed. The Xcode build produced the expected Flapline.saver artifact.

I did not enable auto-merge because this release path is intentionally gated on protected prod Apple signing/notary secrets being configured before unattended release automation is used.

[Hermes-omt]

Reviewed the live PR head 737f3f3bfe6abe5e828affe8ade807cda5af7388 on Hermes after refreshing the stale local worktree. CI is green, the branch is current with main, and auto-merge is already enabled. I found no merge-blocking issues in the notarized release workflow, signing script, dry-run test, or launch docs.

Validation run on Hermes: bash -n scripts/ci/run-macos-notarized-release.sh, bash scripts/ci/test-macos-notarized-release.sh, actionlint .github/workflows/macos-notarized-release.yml, and Xcode project/scheme/build-settings inspection with Xcode 26.6.

Non-blocking note: the docs treat APPLE_DEVELOPER_IDENTITY as required, while the script falls back to Developer ID Application if it is absent. That fallback should still work on a clean runner with only the imported cert, but making it required would give a clearer failure mode.

[Hermes-omt]

Node-local review completed on Hermes (Mac.Home/Darwin) at PR head f7afacc, matching expected. Four commits: upstream merge + paths-filter v4 upgrade + macos-notarized-release workflow + release/test scripts. All 6 CI checks passing. No secrets leaked in diff. Security: ephemeral keychain with EXIT trap cleanup, env-var gate before secret decode, tool-existence preflight on six macOS binaries, dry-run path guarded. Minor non-blocking note: APPLE_DEVELOPER_IDENTITY from secrets is optional and could be empty (codesign fails loudly if so), but current behavior is acceptable as a fast-fail. Branch up-to-date with main. Recommend approve via Pheidon control-plane finalizer.

[Hermes-omt]

Blocking findings:

1. .github/workflows/macos-notarized-release.yml interpolates ${{ inputs.version }} directly into a bash run: block. A manually dispatched value can alter shell syntax before the SemVer check, in a job that receives production signing and notarization secrets. Pass the input through env, read it as a quoted shell variable, then validate it; never interpolate workflow inputs directly into shell source.

2. Manual dispatch builds the selected workflow ref, but gh release create "$tag" does not bind a newly created tag to GITHUB_SHA; an absent tag is created from the default branch. This can publish an artifact built from one commit under a release tag pointing at another. Require and verify refs/tags/v$version resolves to GITHUB_SHA, or explicitly create/verify the tag at GITHUB_SHA before publishing.

After repair, add coverage for the safe input transport and tag/SHA binding, then rerun release-script checks and macOS build validation.