Establish supported macOS production build and installation

[Andesha]

Summary

Establish a supported macOS production build and installation workflow for EEG2BIDS.

This work follows the Linux build in #170. Keep the scope sparse until that issue establishes the shared Electron, renderer, Python-backend, and build architecture.

Initial scope

• Adapt the shared production-build architecture established by Establish supported Linux production packaging and sandbox integration #170 for macOS.
• Select and document a supported macOS package and installation format.
• Define platform-specific installation, upgrade, uninstall, signing, notarization, and startup behavior.
• Verify installation and launch on a clean supported macOS environment.
• Document supported macOS versions and architectures.

Cross-platform signing note

The macOS signing and notarization implementation is platform-specific, but the organizational decisions made here may also inform future Windows code signing. In particular, document:

• who owns and manages signing identities and credentials;
• how protected CI environments access credentials;
• who may authorize signed production releases;
• credential rotation, revocation, and incident-response procedures; and
• artifact provenance and verification requirements.

Windows artifacts produced under #190 remain explicitly unsigned. Applying these shared credential-governance decisions to Windows, and selecting the appropriate Windows certificate and signing service, is separate follow-up work and does not block #190.

Dependency

Blocked by #170. Linux is the first production target and must establish the shared build architecture before this work begins.

Acceptance criteria

• Establish supported Linux production packaging and sandbox integration #170 is complete and its reusable build decisions have been identified.
• Detailed macOS requirements and platform-specific decisions are documented.
• A clean supported macOS machine can install and launch EEG2BIDS without development tooling.
• Signing, notarization, installation, upgrade, uninstall, and clean-machine verification are documented and tested.

[Andesha]

This issue is currently blocked pending the macOS application-signing and notarization details required for a production release.

Before implementation can proceed, please confirm:

• the Apple Developer account and team that will be used;
• who will provide and manage the signing identity and notarization credentials;
• how CI/release workflows will securely access them; and
• any organizational requirements for signing, hardened runtime, entitlements, and notarization.

To avoid building a package that cannot be distributed or launched under supported macOS security policies, work on this issue will remain blocked until these details are available.

[Andesha]

Added a cross-platform signing note: macOS signing/notarization remains platform-specific, while credential ownership, protected CI access, authorization, rotation, and provenance decisions may also inform future Windows signing. Windows remains unsigned under #190.