Add release notarization step

[jmcte]

Summary

Adds the release notarization path for APW.app.

Closes #7.

Changes

• Adds scripts/notarize-native-app.sh to import the Developer ID certificate into a temporary keychain, sign the release CLI and APW.app, submit the app bundle to Apple Notary Service, staple the ticket, and run Gatekeeper assessment.
• Wires .github/workflows/release.yml to run notarization on tagged releases before packaging the release archive.
• Keeps Apple credentials optional: incomplete credentials emit a GitHub warning and skip notarization instead of failing unrelated release automation.
• Removes the unused APPLE_TEAM_ID gate from the script, workflow env, docs, and dry-run test so releases with all actually-used credentials do not skip notarization.
• Adds a regression check that scripts/notarize-native-app.sh does not require APPLE_TEAM_ID, and separates codesigning inputs from notarytool App Store Connect API key inputs.
• Retries interrupted UDP send/receive calls in the native daemon test helper after the CI lint workflow exposed an EINTR unwrap in the test path.
• Adds scripts/test-notarize-native-app.sh and runs it from fast checks to cover missing-required, missing-optional, and dry-run credential paths.
• Documents the release behavior in installation and bootstrap onboarding docs.

Verification

• bash -n scripts/notarize-native-app.sh scripts/test-notarize-native-app.sh passed.
• ./scripts/test-notarize-native-app.sh passed.
• cargo test --manifest-path rust/Cargo.toml daemon::tests::start_daemon_native_routes_requests_and_tracks_host_disconnect -- --nocapture passed outside the sandbox.
• cargo clippy --manifest-path rust/Cargo.toml --all-targets -- -D warnings passed.
• bash scripts/ci/run-fast-checks.sh passed.
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml"); puts "release.yml parses"' passed.
• git diff --check passed.

Notes

The branch commit was created with --no-gpg-sign because gitsign OAuth is not usable in this non-interactive shell. No Apple credentials or auth material are committed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f318eac6a0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove unused APPLE_TEAM_ID from required credentials

Including APPLE_TEAM_ID in required_env causes the script to skip notarization whenever that secret is unset, even though the value is never consumed by signing or notarytool submission in this script. In repos that provide the cert and notary API key material but omit APPLE_TEAM_ID, tagged releases will silently publish without notarization/stapling despite having all actually-used inputs configured.

Useful? React with 👍 / 👎.