[Marc-André Moreau (mamoreau-devolutions)]

Summary

• Support UniGetUI's shared Apple signing and notarization secrets/actions while retaining the existing legacy secret configuration.
• Require notarization credentials for published releases and keep ordinary CI builds unsigned.
• Add a two-stage app/DMG notarization path and validate both stapled artifacts before upload.
• Document the macOS release assets and credential setup.

Validation

• macOS PowerShell suite: 148 passed.
• actionlint passed for CI and release workflows.
• Built and inspected Intel and Apple Silicon DMG fixtures; simulated the external notarization flow and verified the resulting Intel disk image.
• Release assembly regression passed.

The first Intel packaging CI attempt failed during hdiutil create; retrying the failed job succeeded.