Editor S14: macOS notarize button

[mblackman]

P2.

Dedicated Notarize action, separate from Export Build (#74) which emits unsigned/ad-hoc artifacts.

Scope:

• Take a signed macOS export, run xcrun notarytool submit --wait, then xcrun stapler staple
• Notary credentials (Apple ID / app-specific password / team id, or API key) stored in user prefs via keychain
• Surface submission id, status polling, and staple result in the console
• Shells out through the Editor S1: Process-spawn wrapper #46 spawn wrapper

Companion to #53 (ShippingV1: macOS codesign + notarize + staple) — this is the editor-triggered button over the same machinery.

Depends on #74 (export build). Parent: #45.