feat(macos): ship signed universal releases and Homebrew cask

[SarthakWade]

Summary

• Build the macOS host, CLI, and MCP adapter as universal arm64 and x86_64 executables.
• Require Developer ID Application signing, hardened runtime, secure timestamps, explicit Apple notarization acceptance, stapling, and Gatekeeper validation for tagged releases.
• Keep pull request release dry runs credential-free with strict ad-hoc signature and architecture validation.
• Publish a checksum-pinned Homebrew cask through the tap's repository-scoped workflow without granting this repository cross-repository write access.
• Document the Phase 3 distribution contract and close backlog item E1.

Security

• Tagged builds fail closed when signing or notary credentials are absent or invalid.
• Temporary PKCS#12 and API key material uses mode 0600 and is removed in an always-run cleanup step.
• Every bundled executable is validated independently for its architecture set and signing properties.
• The restricted WKWebView passkey entitlement is omitted by default. It can only be requested with an Apple-approved provisioning profile and matching entitlement file for com.headless.app.
• Notarization must explicitly return Accepted; the stapled app is then revalidated with strict code signing and Gatekeeper.

Homebrew tap

The public tap is LockInTime/homebrew-headless. Its self-updating workflow independently verifies release checksums, Developer ID signatures, hardened runtime, secure timestamps, universal architectures, stapling, Gatekeeper, and Homebrew style before updating the cask.

Verification

• pnpm test
• pnpm test:runtime
• pnpm test:e2e:mac
• pnpm test:e2e:linux
• pnpm --filter @headless/web lint
• pnpm --filter @headless/web build
• HEADLESS_ARCHS='arm64 x86_64' ./apps/headless/build.sh
• ./apps/headless/Tests/macos-distribution.sh apps/headless/Headless.app 1.0.2 adhoc 'arm64 x86_64'
• Both CLI slices executed with arch -arm64 and arch -x86_64
• Package dry run and missing-notary-key fail-closed checks
• actionlint, shellcheck, shell syntax checks, git diff --check, and Prettier 3.6.2

Tagged signing and notarization require the repository secrets documented in apps/headless/docs/P3.md. Pull request CI intentionally exercises the universal packaging path without contacting Apple.

Closes #39

[yashranaway]

Reviewed the universal build, hardened-runtime signing, notarization/stapling validation, Homebrew handoff, documentation, and fail-closed release gates. Full CI, real macOS E2E, both Linux archives, universal macOS packaging, and multi-platform container validation are green.