desktop: implement signing + notarization (macOS) and signed releases

[AbdelStark]

Context

Distribution requires signed binaries; required for the privacy story to be credible.

Scope

• macOS notarization workflow in CI.
• Linux AppImage signing.
• Windows MSI signing.
• Maintainer key fingerprints documented.

Out of Scope

Design Reference

• RFC: rfcs/0019-reference-desktop-app.md §3.6

Acceptance Criteria

• Notarized .app distributed via GitHub release
• Signatures verifiable on each platform

Parent tracking issue: #16

[AbdelStark]

Blocked (session-scoped): requires desktop application toolchain not present in this environment.

This issue requires Tauri 2 + the JS/Rust toolchain (cargo, node, pnpm) and, for #82, an Apple Developer account + Developer ID certificate for notarization.

Foundations now in place that the desktop app will plug into:

• geno_lewm.cli.verify ships a working checksum-mode verifier the desktop UI can shell out to.
• geno_lewm.provenance.{Receipt,read_receipt,write_receipt} for the receipt-handling UI.
• geno_lewm.errors exit codes (2/3/4/5/6/7/8/9/130) for the desktop's error-presentation layer.

To unblock: install the Tauri / cargo / node toolchain (and notarization credentials for #82), and pick this up.