ShippingV1 S4: macOS codesign + notarize + staple

[mblackman]

P0.

Engine-side done — scripts/octarine-macos-notarize.sh + entitlements + workflow steps. Blocked on Apple Developer secrets: MACOS_DEVELOPER_ID_P12, MACOSX_DEVELOPER_ID_PASSWORD, APPLE_TEAM_ID, APPLE_ID_USERNAME, APPLE_APP_SPECIFIC_PASSWORD. Without notarize, Gatekeeper rejects every install.

Parent: #44.