Allow signed-only macOS release packaging

[yvette-carlisle]

Summary

• make Apple notarization optional for the macOS release workflow
• sign the release app through the same native-host staging path used locally
• align README and release runbook around signed but unnotarized preview builds

Validation

• actionlint .github/workflows/release.yml
• git diff --check
• /Users/x/.codex/plugins/cache/hack-ink/playbook/0.3.0/scripts/semantic_drift_audit.py (agent verdict: pass; stale --force hit is unrelated scroll replay text)