[macos][release] Add notarized public-beta distribution lane

[100yenadmin]

Summary

The local beta app is Developer ID signed and structurally packaged, but it is not notarized. spctl -a -vv /Volumes/LEXAR/Codex/clawdnd-beta-channel/ClawDnD.app currently rejects the app with source=Unnotarized Developer ID.

This is acceptable for the owner/dev local beta lane in PR #150, but it blocks a public or less-technical beta distribution path.

Current Evidence

• Packaging script: script/package_macos_beta.sh
• Bundle ID: dev.clawdnd.app
• Local channel: /Volumes/LEXAR/Codex/clawdnd-beta-channel
• Appcast: file:///Volumes/LEXAR/Codex/clawdnd-beta-channel/appcast.xml
• Signing identity: Developer ID Application: Andrew Ryan (TC6MS3T6NN)
• Validation report: /Volumes/LEXAR/Codex/clawdnd-beta-channel/validation-report.md

Observed validation:

codesign --verify --deep --strict /Volumes/LEXAR/Codex/clawdnd-beta-channel/ClawDnD.app
spctl -a -vv /Volumes/LEXAR/Codex/clawdnd-beta-channel/ClawDnD.app || true

codesign passes. spctl rejects as unnotarized.

Architecture Boundary

Notarization should remain release-trust work. It should not change engine/viewer state ownership, OpenWorlds screen contracts, provider launch semantics, or campaign storage.

Implementation Plan

1. Add a notarization profile discovery step to script/package_macos_beta.sh or a separate release script.
2. Submit the zipped .app or DMG with xcrun notarytool submit --wait.
3. Staple the accepted ticket with xcrun stapler staple.
4. Re-run:
   • codesign --verify --deep --strict
   • spctl -a -vv
   • Sparkle appcast generation/signing
5. Record notarization status in validation-report.md.

Acceptance Criteria

• A packaged app from the beta/release lane passes Gatekeeper assessment without || true.
• validation-report.md distinguishes codesign, notarization submission, stapling, and spctl results.
• The release script fails with a clear message when no notary profile is configured.
• Local dev builds and owner-only local beta packaging still work when notarization is intentionally skipped.

Focused Validation

./script/package_macos_beta.sh --version 0.3.0 --build 2026052601 --channel local-beta
codesign --verify --deep --strict /Volumes/LEXAR/Codex/clawdnd-beta-channel/ClawDnD.app
spctl -a -vv /Volumes/LEXAR/Codex/clawdnd-beta-channel/ClawDnD.app

[coderabbitai]

🔗 Related PRs

#103 - feat(macos): add Codex player-facade provider wrapper [merged]
#124 - docs(openworlds): add fidelity and asset contract [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!