Prepare signed macOS release pipeline - #7

Summary

• add a tag-driven universal macOS signing, notarization, verification, and GitHub Release workflow
• fix packaged resource lookup and include required helper scripts
• add DMG install layout and SHA-256 checksums
• make telemetry opt-in as documented
• document installation and release prerequisites

Verification

• 23 Swift tests pass
• local ad-hoc app passes strict code-signature verification
• ZIP integrity, DMG integrity, packaged resources, checksum verification, and Applications shortcut verified
• no high-confidence credential patterns found in reachable Git history

Remaining release prerequisite

The repository must configure the documented Apple Developer signing/notarization Actions secrets before pushing the first version tag.