Build signed, notarized, and published desktop releases

[atimics]

Context

PR #2 adds CI package builds and uploads generated installers as workflow artifacts, but release artifacts are still unsigned/ad-hoc signed and not published through a release workflow.

For a local crypto desktop app, release authenticity is part of the security model. Users need to know the binary came from this repo and was not modified in transit.

Scope

• Add a tag-driven release workflow, e.g. v* tags.
• Produce macOS arm64, macOS x64, Windows, and Linux artifacts.
• Add macOS signing and notarization.
• Add Windows code signing when credentials are available.
• Keep Linux AppImage/deb outputs in the release bundle.
• Publish checksums for every release artifact.
• Document which artifacts are signed/notarized and which are not.

Acceptance criteria

• A release tag creates GitHub Release artifacts without committing dist/ output.
• macOS artifacts are notarized or explicitly marked as unsigned test artifacts.
• Windows artifacts are signed or explicitly marked as unsigned test artifacts.
• Checksums are attached to the release.
• The release process can be repeated from a clean checkout with npm ci.