Fix macOS signing: add hardened runtime and prevent jpackage recursion

- Build app bundle first with jpackage --type app-image
- Sign all nested binaries with hardened runtime (required for notarization)
- Create DMG from pre-signed app bundle using hdiutil
- Add cleanup step to prevent infinite recursion in jpackage
- Improve notarization error reporting with detailed logs

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: ledhed2222

.github/workflows/build-installers.yaml

@@ -61,6 +61,9 @@ jobs:
           CERT_IDENTITY=$(security find-identity -v -p codesigning | grep "Developer ID Application" | head -1 | sed -n 's/.*"\(.*\)"/\1/p')
           echo "Using certificate: $CERT_IDENTITY"
 
+          # Remove any existing app bundle to prevent recursion
+          rm -rf target/EWItool.app
+
           # First create just the app-image (app bundle), not DMG yet
           jpackage \
             --type app-image \