feat(release): sign + notarize darwin binaries, lock down release egress

[ryanlewis]

What

• Sign + notarize the darwin binaries via goreleaser's native notarize block (quill) — runs on the existing ubuntu-latest runner, before archiving, so tarballs/checksums/attestations all cover the signed Mach-O. wait: true means a rejected notarization fails the release before anything is published.
• Drop the cask de-quarantine hack — Gatekeeper passes the notarized binary, including the completions-generation run at install time.
• Preflight secret check — a missing signing secret fails the release loudly instead of silently shipping unsigned binaries with a hookless cask.
• Egress block mode on the release job (was audit) with an explicit allowlist, since the job now holds signing keys. Shai-hulud-style exfil from a compromised dep/action is limited to the listed endpoints.
• .github/SIGNING.md — credential setup, rotation, and leak-response runbook.

Before the next release (manual, see .github/SIGNING.md)

• Export the Developer ID Application cert + key as a .p12 (Keychain Access); store the password
• Create an App Store Connect API key (Developer role); note issuer ID + key ID, keep the .p8
• gh secret set the five MACOS_* secrets into the release environment
• Optionally cross-check the egress allowlist against the harden-runner audit reports from the v0.5.x release runs

Merging before the secrets exist is safe — the preflight step just fails any tagged release until they're in place.

Caveats

• Bare Mach-O binaries can't be stapled; Gatekeeper does an online notarization lookup on first run (fine for brew/curl installs, only bites fully-offline first runs).
• First notarization on a young account can be slow — notarize timeout is 30m, goreleaser --timeout raised to 60m.
• The egress allowlist is reconstructed, not measured; if the first signed release blocks a legitimate endpoint, the harden-runner report names it — add it deliberately.