fix: re-sign macOS binaries in CI to fix Gatekeeper rejection on macOS 26

Go's linker produces ad-hoc signatures with the `linker-signed` flag
(0x20002), which macOS 26 (Tahoe) rejects for downloaded binaries.
Running `codesign --force --sign -` after build converts it to a proper
ad-hoc signature (0x2) that Gatekeeper accepts.

Author: ourines

.github/workflows/release.yml

@@ -201,6 +201,10 @@ jobs:
           ./codes version
         fi
 
+    - name: Sign macOS binary
+      if: matrix.goos == 'darwin'
+      run: codesign --force --sign - codes
+
     - name: Upload artifact
       uses: actions/upload-artifact@v4
       with: