Create a release signing and notarization checklist

[culpen90]

Why

The packaging script can build and ad-hoc sign a local .app, and the README includes the basic commands for Developer ID signing and notarization. A release checklist would make public macOS builds more repeatable and help contributors understand what can and cannot be verified without signing infrastructure.

Where to start

• README.md
• CONTRIBUTING.md
• Scripts/package-macos-app.sh
• .github/workflows/release.yml
• A new docs/releases.md, if useful

Suggested approach

Write a concise release checklist for maintainers. It should cover local packaging, universal build expectations, Developer ID signing, notarization submission, stapling, Gatekeeper verification, ZIP verification, and what to do when testing ad-hoc builds locally.

Acceptance criteria

• The checklist distinguishes local ad-hoc builds from public notarized downloads.
• The checklist includes the commands needed to package, verify, zip, notarize, staple, and smoke-test a release.
• The checklist documents expected environment variables such as SIGN_IDENTITY, ZIP_APP, VERSION, and BUILD_NUMBER where relevant.
• The README links to the checklist if a new docs file is added.

Testing

• Run bash -n Scripts/package-macos-app.sh if the script is touched.
• Follow the local ad-hoc packaging steps and confirm they still match the repo.