Prepare signed multi-architecture app distribution

[KulmanD]

What changed

• add separate Apple Silicon and Intel release packaging
• sign nested executables and support Developer ID hardened-runtime signing
• optionally notarize, staple, and Gatekeeper-check public artifacts
• verify fresh extraction, exact architecture, signatures, privacy exclusions, test linkage, and checksums
• add CI validation artifacts for both architectures
• document nontechnical architecture selection and the owner release workflow

Why

mx3-lite needs a reproducible public distribution path without adding a universal-binary disk penalty or changing the lightweight worker.

Validation

• swift build
• swift build -c release
• generated defaults check
• shell syntax and workflow YAML parse
• local arm64 and x86_64 cross-builds
• fresh extraction/signature/architecture/privacy verification for both archives
• checksum verification
• source archive exclusion scan
• Start/Status/Stop lifecycle with no remaining process
• no diff under Sources/, Package.swift, or app/Info.plist from the Standardize configuration defaults and remove machine-specific naming #26 base

Risks and remaining owner steps

This PR intentionally remains draft. The repository is private and has no selected license. Real Developer ID signing, Apple notarization, clean-machine Gatekeeper testing on Apple Silicon and Intel, public visibility, and signed-out release-link verification require owner credentials or decisions and are documented rather than simulated. Ad-hoc artifacts are validation-only and are labeled accordingly.

Depends on #36 for neutral generated config defaults. Closes #27 after the documented owner publication gates are completed.

[KulmanD]

Superseded by draft PR #40, which contains this change, its performance evidence, the complete accepted integration, and passing final CI. Closing this draft without merging avoids duplicate commits. The branch is intentionally retained for isolated comparison and deferred measurements.