GitHub is unsuspended, so releases move back from Gitea to GitHub, with the
Gitea mirror kept as a fallback.
- release.yml: re-enable as the active path and wire up Developer-ID signing
+ notarization for the macOS jobs. The Apple steps are guarded on the
secrets being present, so the workflow stays green (ad-hoc signed) until
they are configured.
- release.yml: re-sign the bundled PostgreSQL/MariaDB client binaries with
the Developer ID identity + hardened runtime + timestamp — Apple rejects
ad-hoc-signed nested executables during notarization.
- release.yml: move the Homebrew cask bump to the `release: published` event.
It previously ran on tag push, but the releases/tags API does not serve
drafts, so it could never download the DMGs. It now also skips cleanly
when HOMEBREW_TAP_TOKEN is unset rather than failing the workflow.
- release.yml: drop the stale header note claiming this is not the active
release path.
- README + cask template: point downloads, issues, releases and the Homebrew
tap back at github.com/AdrianBonpin.
adrianbonpin