macOS signing and notarization

[thedavidweng]

Problem

OpenLoop uses ad-hoc code signing. macOS Gatekeeper shows a security warning on first launch for DMG installs, requiring manual bypass. This blocks distribution to non-technical users.

Scope

• Apple Developer ID certificate setup
• Notarization integration in the CI release workflow
• Remove Gatekeeper bypass instructions from README and release notes (no longer needed)

Acceptance criteria

• DMG builds are signed with a Developer ID certificate
• Builds are notarized via xcrun notarytool in CI
• First launch shows no Gatekeeper warning
• Gatekeeper bypass instructions removed from docs