ci: add macOS code signing and notarization to release workflow

The tauri-action automatically handles signing and notarization
when APPLE_CERTIFICATE, APPLE_SIGNING_IDENTITY, APPLE_ID,
APPLE_PASSWORD, and APPLE_TEAM_ID env vars are set.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: stultus

.github/workflows/release.yml

@@ -59,6 +59,14 @@ jobs:
         uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # macOS code signing — signs the app with a Developer ID certificate
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          # macOS notarization — submits the signed app to Apple for notarization
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         with:
           tagName: ${{ github.ref_name }}
           releaseName: 'Scriptty ${{ github.ref_name }}'