fix: use native macOS DMG signing

[wimi321]

Summary

• sign final macOS DMG containers through electron-builder while its temporary Developer ID keychain is active
• keep final DMG notarization, stapling, signature verification, Gatekeeper assessment, and image verification as blocking release gates
• remove the brittle post-package signing step that failed after electron-builder cleaned up its temporary keychain
• document and contract-test the complete outer-container trust chain

Failure addressed

Release validation run 31247168298 proved that the application bundles were signed correctly, but the post-package workflow could no longer find the Developer ID identity. This change moves DMG signing into electron-builder via build.dmg.sign=true.

Verification

• pnpm check
• 243 tests passed
• TypeScript passed
• production build passed
• workflow YAML parsed successfully
• macOS notarization contract passed