chore(release): ad-hoc sign macOS builds

Configure Tauri to ad-hoc sign macOS app and DMG builds without Apple Developer credentials.

Add a macOS signing verifier that checks the built app, the DMG payload, Mach-O signatures, quarantine xattrs, and expected Gatekeeper behavior.

Tighten README copy while keeping the platform install pills and accurate non-notarized macOS guidance.

src-tauri/tauri.macos.conf.json

@@ -22,6 +22,10 @@
     ]
   },
   "bundle": {
-    "targets": ["app", "dmg"]
+    "targets": ["app", "dmg"],
+    "macOS": {
+      "signingIdentity": "-",
+      "hardenedRuntime": true
+    }
   }
 }