feat: Developer-ID sign + notarize macOS builds

- tauri.conf.json: enable hardenedRuntime + entitlements (keep ad-hoc
  signingIdentity as the dev default; release script overrides it)
- add desktop/src-tauri/entitlements.plist (JIT / unsigned-exec-mem /
  dyld-env-vars for the hardened runtime)
- scripts/release-mac.sh: auto-detect Developer ID identity from the
  keychain, load notarization creds from ~/.config/gridline/notarize.env
  (App Store Connect API key), re-sign bundled pg tools after
  install_name_tool (invalidated signatures would fail notarization),
  and verify codesign + stapled notarization before upload
- README/AGENTS.md: replace the unsigned/xattr instructions with the
  macOS signing & notarization setup guide

AGENTS.md

@@ -184,7 +184,7 @@ Cut a release by tagging the **`prod`** branch once the PR is merged — `git ta
 - `desktop/src/lib/version.test.ts` and `desktop/src/lib/docs-coverage.test.ts` if they assert the version
 - **README download links are static (versioned)** — both download tables (top **Download** section + **Which file should I download?**) link directly to the release-tag assets (`releases/download/v0.7.9/<file>`). tauri-action uses default versioned asset names (`Gridline_<ver>_aarch64.dmg`, `Gridline-<ver>-1.x86_64.rpm`, etc.) — update BOTH tables to the new names on every release (see the MAINTENANCE comment in README.md).
 - **Bundled pg tools:** `tauri.conf.json` `bundle.resources` lists `resources/pg_tools/*`; the `release.yml` matrix builds/downloads + checksum-verifies the static binaries before the Tauri build step.
-- **Release notes must include the macOS first-launch instructions** — until a Developer ID signing certificate is secured, releases are ad-hoc signed only (not notarized), so every macOS user hits a Gatekeeper prompt. The draft release body must include: right-click → **Open** → **Open** (or System Settings → Privacy & Security → **Open Anyway**) for "developer cannot be verified", and `sudo xattr -dr com.apple.quarantine /Applications/Gridline.app` (with the re-run-after-every-upgrade note) for "damaged and can't be opened".
+- **macOS is Developer-ID signed + notarized** via `scripts/release-mac.sh` (built manually on Adrian's machine; not in CI). The script auto-detects the Developer ID identity from the login keychain, reads notarization credentials from `~/.config/gridline/notarize.env` (App Store Connect API key), and verifies codesign + stapled notarization before uploading. If the cert or credentials are missing it fails with setup instructions (see the README's "macOS signing & notarization" section).
 
 ### Adding a Tauri Command