Fix macOS release codesign failure caused by empty Apple secrets env vars - #33

The release (macos-latest, aarch64-apple-darwin, dmg,app) job was failing during the "Build and Release" step with:

security: SecKeychainItemImport: One or more parameters passed to a function were not valid.
failed to bundle project: failed codesign application: failed to run command security import: failed to import keychain certificate

This happened even though Flint intentionally ships unsigned macOS builds when no Apple signing secrets are configured.

Root cause

• tauri-bundler checks for a certificate via Rust's env::var_os("APPLE_CERTIFICATE"), which returns Some("") — not None — for an env var that GitHub Actions sets to an empty string.
• The workflow's "Build and Release" step set APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }} (and 5 related vars) unconditionally as step env:. With the secret unset, this created an empty-but-present env var.
• tauri-bundler treated the empty value as "a certificate was provided," tried to base64-decode it into a .p12, and called security import on the resulting empty file — which fails.

Fix

• .github/workflows/release.yml: the "Check Apple signing secrets" step now forwards APPLE_CERTIFICATE, APPLE_CERTIFICATE_PASSWORD, APPLE_SIGNING_IDENTITY, APPLE_ID, APPLE_PASSWORD, APPLE_TEAM_ID to $GITHUB_ENV only when APPLE_CERTIFICATE is genuinely non-empty.
• The "Build and Release" step no longer sets those six vars in its own env: block, so on an unsigned build they're truly absent from the process environment rather than empty strings — matching what var_os expects.