fix(release): read notary issuer_id/key_id from vars not secrets

[hmk]

Summary

`MACOS_NOTARY_ISSUER_ID` and `MACOS_NOTARY_KEY_ID` are stored as variables (not secrets) in the `release` environment. The workflow was reading them via `secrets.*`, which silently resolved to empty strings.

Goreleaser then hit this skip path:

https://github.com/goreleaser/goreleaser/blob/main/internal/pipe/notary/macos.go#L103-L107

if cfg.Notarize.IssuerID == "" || cfg.Notarize.KeyID == "" || cfg.Notarize.Key == "" {
  log.WithField("binary", bin.Path).Info("will not try to notarize")
  continue
}

So v0.1.2 was signed but not notarized.

Test plan

• Merge → empty fix commit on main → release-please opens 0.1.3 PR → merge → goreleaser run logs `notarizing` lines per darwin binary
• Download v0.1.3 darwin tarball, run `spctl --assess --type execute -vv ./try`, confirm `source=Notarized Developer ID`

🤖 Generated with Claude Code