Implement macOS Developer ID signing and notarization in the release workflow

[eimexdev]

Part of OpenBeat v0.1.0 public launch map.

Question

What CI and packaging changes implement the macOS signing and notarization strategy selected by the signing research?

Goal

Produce a GitHub Release .pkg that is signed with Developer ID, notarized by Apple, stapled, and verifiable after download.

Work

• Sign the bundled OpenBeat executable and package in the correct order.
• Add notarization and stapling to the macOS release build.
• Store certificates and Apple credentials safely in GitHub Actions secrets.
• Add verification steps that fail the release on an invalid signature or notarization result.
• Document local verification and credential rotation.
• Test the downloaded artifact on a clean macOS user account.

Acceptance criteria

The final release package passes the selected codesign/pkgutil/spctl and notarization checks and installs without requiring an unsigned-package bypass.