release(macos): ship a Developer ID signed and notarized build

[tcballard]

Objective

Turn Sorting Hat’s experimental ad-hoc-signed build into a trustworthy macOS distribution that installs and launches without manual Gatekeeper workarounds.

This is the second post-WWDC26 milestone and can proceed independently from routing-quality experimentation once PR #22 is merged.

Scope

• Confirm the Apple Developer team, Developer ID Application certificate, bundle identifier, and signing identity.
• Enable hardened runtime and define the minimum required entitlements.
• Sign the app bundle and all nested executable code consistently.
• Archive a reproducible release artifact.
• Submit the archive to Apple’s notary service, wait for acceptance, and staple the ticket.
• Validate the final artifact with codesign, spctl, and stapler.
• Update the release workflow and Homebrew cask/install documentation.
• Test installation and first launch from a freshly downloaded artifact.
• Document certificate, secret, and CI boundaries without committing credentials.

Acceptance criteria

• Release builds use the maintainer’s Developer ID Application identity and hardened runtime.
• Every nested executable passes strict signing verification.
• Apple notarization succeeds and the ticket is stapled to the distributed artifact.
• spctl --assess accepts the final app on a clean verification path.
• A downloaded release installs and launches without Privacy & Security → Open Anyway.
• CI/release automation fails closed when signing or notarization inputs are missing or invalid.
• Homebrew installation verifies the final published archive.
• README warnings and installation instructions match the shipped trust state.
• No certificate, private key, app-specific password, or API credential enters git history or logs.

Excluded

• Mac App Store distribution and sandbox migration.
• Routing-quality or prompt changes tracked in quality(routing): earn a passing representative-corpus benchmark #23.
• Automatic updater infrastructure unless required by the chosen distribution mechanism.
• Marketing video and launch campaign production.

Owner prerequisites

• Active Apple Developer Program membership.
• Developer ID Application certificate available locally or through an approved CI secret path.
• App Store Connect notarization credentials or API key.

Depends on: PR #22 for the final README baseline.