- tauri.conf.json: enable hardenedRuntime + entitlements (keep ad-hoc
signingIdentity as the dev default; release script overrides it)
- add desktop/src-tauri/entitlements.plist (JIT / unsigned-exec-mem /
dyld-env-vars for the hardened runtime)
- scripts/release-mac.sh: auto-detect Developer ID identity from the
keychain, load notarization creds from ~/.config/gridline/notarize.env
(App Store Connect API key), re-sign bundled pg tools after
install_name_tool (invalidated signatures would fail notarization),
and verify codesign + stapled notarization before upload
- README/AGENTS.md: replace the unsigned/xattr instructions with the
macOS signing & notarization setup guide
adrianbonpin