ci: add macOS code signing for CLI binary (#42)

[tamtom]

Summary

• Add sign-macos job to the release workflow that signs macOS binaries (amd64 + arm64) with an Apple Developer ID certificate
• Import certificate from GitHub Secrets into a temporary keychain, sign with codesign --force --options runtime --timestamp, and verify signatures
• Optionally notarize binaries via xcrun notarytool when Apple ID secrets are configured (conditional on APPLE_ID being set)
• Signed artifacts overwrite the unsigned ones so the release job publishes signed binaries
• Linux and Windows builds are completely unaffected

Required Secrets

Secret	Description
APPLE_CERTIFICATE_P12	Base64-encoded Developer ID Application certificate
APPLE_CERTIFICATE_PASSWORD	Password for the .p12 file
APPLE_SIGNING_IDENTITY	e.g., Developer ID Application: Name (TEAM_ID)
APPLE_ID	Apple ID email (optional, for notarization)
APPLE_TEAM_ID	Apple Developer Team ID (optional, for notarization)
APPLE_APP_PASSWORD	App-specific password (optional, for notarization)

Test plan

• Verify workflow YAML is valid (no syntax errors)
• Add the three required signing secrets and trigger a tag push to test the signing job
• Confirm codesign --verify passes in the workflow logs
• Download the signed binary and verify locally with codesign -dvv gplay-darwin-arm64
• Confirm macOS Gatekeeper does not show warnings when running the signed binary
• Optionally add notarization secrets and verify xcrun notarytool submit succeeds
• Confirm Linux and Windows artifacts are still produced correctly

Closes #42

🤖 Generated with Claude Code