Configure macOS + Windows signing for desktop releases

[aledefra]

Summary

• enable macOS hardened runtime signing config and notarization integration in electron-builder
• add explicit mac entitlements files used for Electron runtime signing
• keep Windows executable signing enabled and document required env vars
• add a GitHub Actions workflow to build macOS + Windows artifacts and publish them to a GitHub Release on v* tags
• document required repository secrets and release trigger in README

Validation

• npm run lint
• npm run build
• npm run dist:mac -- --dir
  • confirmed app signing step executes
  • notarization is skipped when Apple notarization env vars are not provided
• ruby YAML parse check for .github/workflows/release.yml