fix: preserve macOS JVM entitlements

[openai0229]

Summary

• preserve the upstream Temurin Developer ID signatures and JVM entitlements in the jlink runtime
• continue signing the newly built embedded CLI with the Chat2DB Developer ID identity
• fail package verification when libjvm is missing JIT, unsigned-executable-memory, or library-validation entitlements

Runtime evidence

The notarized ARM64 artifact from run 33050635049 passed signature and Gatekeeper checks but crashed on this SIP-enabled Apple Silicon Mac during java -version. The crash report terminates with SIGTRAP in pthread_jit_write_protect_np. The re-signed libjvm had no entitlements; the prior working Temurin runtime carries the required Eclipse Developer ID signature and JVM entitlements. The invalid package was not installed.

Verification

• bash syntax checks
• shellcheck packaging scripts
• git diff --check
• required-entitlement checks against the working installed Temurin runtime
• installed Temurin java -version