Ship signed release + publish Homebrew tap (blocked on Apple Developer account)

[GregTheGreek]

Distribution is blocked until the Apple Developer Program membership clears review: a Developer ID Application certificate is only issued to active members, and without it we cannot sign or notarize. An unsigned build trips Gatekeeper, so no public release (or working Homebrew cask) is possible until then.

Groundwork already merged/staged:

• CI no longer signs; release-please only versions/tags/publishes (ci: move release signing local, keep versioning automated #10).
• Homebrew cask template + make cask helper staged in packaging/ (feat: stage Homebrew cask and make cask helper #11).

Once the account clears

• Local signing setup: confirm a "Developer ID Application" identity is in the keychain; create the notarytool profile once (xcrun notarytool store-credentials trapps-notary --key <p8> --key-id <id> --issuer <uuid>).
• Produce a notarized zip and attach it to the release (backfill v0.2.0, which currently has no assets):
  • make release && make notarize
  • gh release upload v0.2.0 build/Trapps-0.2.0.zip
• Create the public repo GregTheGreek/homebrew-tap with a Casks/ directory.
• Render and publish the cask: make cask, then copy build/trapps.rb to homebrew-tap/Casks/trapps.rb and push.
• Verify: brew install --cask gregthegreek/tap/trapps installs and launches cleanly; run brew audit --cask on the rendered cask.
• Update the README Install section to add the brew install --cask gregthegreek/tap/trapps option.
• Optional: extend make cask (or add make publish-cask) to push the rendered cask to the tap automatically once the tap exists.

Notes:

• Personal tap now; official Homebrew/homebrew-cask (shorter brew install --cask trapps) can be submitted later once there's traction.
• No credentials belong in this repo or in CI - signing stays local by design.