fix(release): sign and verify macOS binaries

[epodivilov]

Summary

• run the release pipeline on a native macOS arm64 runner with Bun pinned to 1.3.14
• ad-hoc sign both Darwin artifacts after their final bytes are written
• strictly verify both signatures and smoke-test the native artifact before creating or publishing a release
• preserve all existing release asset names and installer/self-update contracts

Verification

• bash -n scripts/build-release.sh scripts/release-publish.sh scripts/install.sh scripts/verify-release.sh
• pnpm build:release
• pnpm lint
• pnpm typecheck
• pnpm test (703 tests)
• pnpm build
• git diff --check

macOS-only codesign and native artifact checks are enforced by the release workflow and cannot run on this Linux host.

Vikunja: WTK-71