feat: add unsigned macOS release pipeline

[JNHFlow21]

Summary

• build a universal macOS app artifact with explicit ad-hoc signing
• publish app and Python source artifacts from version tags
• verify the release script in CI

Verification

• 72 unit tests + 1 integration test
• universal arm64/x86_64 bundle verified with lipo
• ad-hoc code signature verified with codesign
• privacy scan passed

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1e6da44f75

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove the unsupported brew trust step

When a tag creates this prerelease, the only advertised install command stops at brew trust --tap JNHFlow21/tap, so the subsequent cask installation never runs. Homebrew documents tap as brew tap [options] [user/repo] and does not provide a trust subcommand; remove this step (or replace it with a supported quarantine-handling instruction) so the release notes are executable. Homebrew manpage

Useful? React with 👍 / 👎.