ci(release): publish signed macOS desktop assets

[fettpl]

Feature Description

Add a release workflow path that publishes signed macOS desktop assets for vLLM Studio on stable GitHub Releases.

cc @0xSero — CODEOWNERS lists you as the default owner for this repository, and this follows up on #140 with the CI/release work needed before a Homebrew Cask PR can be prepared.

Problem Statement

The current release pipeline creates GitHub tags/releases, but it does not attach desktop artifacts. That keeps downstream packaging blocked because Homebrew needs a stable public artifact URL and checksum.

Current evidence:

• The release workflow says releases are tags and GitHub Release notes only.
• release.config.cjs uses semantic-release with @semantic-release/github, but no asset publishing configuration.
• frontend/desktop/electron-builder.yml already defines macOS dmg and zip targets for arm64.
• The latest checked release, v1.49.1, has no attached assets.

Proposed Solution

Extend the release workflow so stable releases build and attach macOS desktop artifacts:

• Build the frontend desktop distribution with npm run desktop:dist.
• Attach the Apple Silicon DMG and/or ZIP output to the GitHub Release.
• Ensure asset names include the release version and architecture.
• Keep assets public and downloadable without authentication.
• Document the required macOS signing/notarization secrets and failure mode when they are missing.

Acceptance Criteria

• A stable GitHub Release includes a public arm64 macOS .dmg and/or .zip.
• The published asset installs vLLM Studio.app.
• The asset can be downloaded directly from GitHub Releases and checksummed by Homebrew.
• Release automation does not publish unsigned/unnotarized macOS assets as stable artifacts.
• The workflow or release docs identify the secrets needed for signing/notarization.

Additional Context

This issue is intentionally narrower than #140. It covers publishing the macOS release artifacts. A separate follow-up tracks version alignment between tags, app metadata, and artifact names.

[fettpl]

@0xSero current state update:

I opened the implementation PR here: #150

What the PR does:

• Moves the release workflow to macos-latest.
• Validates required signing/notarization env before release asset builds.
• Applies semantic-release's computed version before desktop packaging.
• Runs npm --prefix frontend run desktop:dist during semantic-release prepare.
• Verifies versioned arm64 DMG, ZIP, DMG blockmap, ZIP blockmap, and latest-mac.yml before publishing.
• Configures @semantic-release/github to attach the desktop assets to the GitHub Release.
• Documents the required release secrets in CONTRIBUTING.md.

Important dependency:

• PR ci(release): publish macOS desktop assets #150 is currently stacked on release: align desktop release versions #149 because asset filenames and app metadata need the release-version alignment from release: align desktop release versions #149.
• After release: align desktop release versions #149 is merged, ci(release): publish macOS desktop assets #150 should be rebased so the macOS asset PR only carries the ci(release): publish signed macOS desktop assets #147 changes.

Owner-pending steps:

• Configure repository secrets: CSC_LINK, CSC_KEY_PASSWORD, APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, and APPLE_TEAM_ID.
• Confirm the certificate in CSC_LINK matches the Electron Builder identity currently configured as sherif cherfa (TZ447KHNZL), or adjust the identity/config before release.
• Run/observe the first release workflow after merge.
• Validate the produced DMG/ZIP with codesign, spctl, and a clean first-run launch.
• Once a stable public DMG/ZIP exists on a GitHub Release, we can proceed with the Homebrew cask PR.

Local validation completed:

• npm run test:release-assets
• npm run test:release-version
• git diff --check --cached
• node scripts/validate-desktop-release-env.mjs without owner secrets exits 1 and reports all required missing env vars.
• npm run check:structure
• npm run check:controller
• npm run check:cli
• npm --prefix frontend run check:quality
• Pre-push hook reran npm --prefix frontend run check:quality successfully.

Known unrelated state:

• npm run check:contracts still fails on current main because AggregatedSession is exported in both frontend/src/app/api/agent/sessions/all/route.ts and frontend/src/features/agent/session-contracts.ts.