macOS notarization fails: required agreement missing or expired

[lnagel]

Both macOS jobs in build.yml fail during notarization. Linux succeeds.

failed to notarize app: Error: HTTP status code: 403.
A required agreement is missing or has expired. This request requires an
in-effect agreement that has not been signed or has expired.

Runs: 31094094626, 31097702169 — reproducible, fails before any artifact is produced.

Impact: blocks v2.0.0-beta.25. Tagging now yields a Linux-only release: no .dmg, no .app.tar.gz, and latest.json without macOS entries.

Fix (needs Account Holder, not Admin — signing identity is Developer ID Application: Madis Vin):

• developer.apple.com/account — look for a "Review Agreement" banner (usually an updated Apple Developer Program License Agreement)
• App Store Connect → Business — check agreement status and that membership hasn't lapsed

Apple doesn't name the agreement over the API, so it has to be checked in the portal.