fix: require notarized desktop packages

[openai0229]

Summary

• require Developer ID signing and Apple notarization for every macOS package build
• pre-sign the embedded CLI and every jlink Mach-O with hardened runtime and trusted timestamps
• remove the workflow switch that allowed unsigned or unnotarized macOS artifacts
• remove test-package labeling from platform manifests and documentation

Verification

• actionlint .github/workflows/package.yml
• shellcheck packaging scripts
• bash syntax checks
• git diff --check

Failure reproduced

Authorized package run 33045641973 correctly failed because the embedded CLI was not Developer ID signed. This patch fixes that source-to-package gap and keeps the existing package verifier fail-closed.