ci: add developer id release workflow

[ai-eks]

Summary

• Add the Developer ID DMG release workflow directly to the MousePortal source repository.
• Add the Developer ID entitlements file required by the package script.
• Add the Developer ID DMG packaging script with source-root paths adjusted for this repository.

Why

The previous release workflow lived in MousePortal-dev and checked out MousePortal as a submodule. That fails when the source repository is private unless a SUBMODULE_TOKEN is configured. Keeping the release workflow in the source repository avoids the submodule checkout step entirely and lets tags in ai-eks/MousePortal build releases directly.

Validation

• bash -n tools/package-developer-id.sh
• git diff --check origin/main...HEAD
• swift test

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 600060b2a9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[ai-eks]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cb3ab7609d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Use portable asset names in checksum files

Because the default DIST_DIR is absolute, this writes the CI path (for example /.../dist/developer-id/MousePortal-1.0.0.dmg) into the released .sha256 file. I checked shasum --help: -c verifies a former output and uses the printed FILE name, so users who download the .dmg and .sha256 into any other directory will have shasum -c fail even though the asset is present. Generate the checksum from inside DIST_DIR or rewrite the filename to $(basename "$DMG_PATH").

Useful? React with 👍 / 👎.

[ai-eks]

Followed up in #3 with a surgical fix.

The checksum is now generated from inside DIST_DIR, so the .sha256 file records MousePortal-<version>.dmg instead of the absolute CI path. Validation covered bash -n tools/package-developer-id.sh, git diff --check, and a temporary shasum -c smoke test.