Add signed macOS DMG release pipeline

[shaohaozhi286]

What changed

• add a native Install ACECode.app that installs only to ~/Applications/ACECode.app
• add deterministic DMG creation, Developer ID signing, notarization, stapling, and Gatekeeper checks
• extend the package workflow to build Intel and Apple silicon DMGs and attach them to GitHub Releases
• add release documentation, installer safety checks, and focused tests

User impact

Users open the DMG and double-click Install ACECode.app. Installation remains entirely in the current user's home directory and never requests administrator privileges.

Verification

• built and Developer ID-signed the CLI, desktop app, installer, and local x64 DMG
• mounted the DMG and verified its contents, bundle identifiers, and signatures
• 6 focused user-install policy tests passed
• macOS release script contract test passed
• web tests and production build passed
• workflow YAML parsing, git diff --check, plist validation, and strict OpenSpec validation passed

The full C++ suite was also run. Parallel execution produced resource-contention failures; serial reruns reduced this to four failures in unrelated browser registry, TUI render, and state-file tests.