build(mac): 📦 Add Apple Developer code signing support

[jorben]

Summary

• Add macOS entitlements plist for Electron hardened runtime (JIT, unsigned memory, library validation, network client)
• Configure electron-builder with code signing settings (hardenedRuntime, entitlements, forceCodeSigning: false)
• Pass CSC_LINK / CSC_KEY_PASSWORD environment variables in CI for automatic signing

Changes

File	Change
build/entitlements.mac.plist	New — hardened runtime entitlements for Electron
package.json	Add signing fields to build.mac section
.github/workflows/release.yml	Pass certificate secrets to build step

Motivation

macOS builds are currently unsigned, causing users to see "unidentified developer" Gatekeeper warnings on download. This PR adds Apple Developer ID code signing support so that signed DMGs can be distributed without security prompts.

The approach uses electron-builder's built-in CSC_LINK / CSC_KEY_PASSWORD mechanism, which handles keychain management internally — keeping the CI config minimal and reliable.

forceCodeSigning: false ensures contributors and forks without Apple certificates can still build unsigned artifacts without errors.

Test Plan

• Signed build (CI): Push a pre-release tag with APPLE_CERTIFICATE and APPLE_CERTIFICATE_PASSWORD secrets configured → verify signing output in Actions log
• Unsigned build (local): CSC_IDENTITY_AUTO_DISCOVERY=false npm run build:mac → build succeeds without certificate
• Fork build: Fork without secrets can build macOS DMG without errors
• Entitlements: codesign -d --entitlements :- release/mac-arm64/MarkPDFdown.app shows all 4 entitlements

Required GitHub Secrets

Secret	Description
APPLE_CERTIFICATE	Base64-encoded .p12 Developer ID Application certificate
APPLE_CERTIFICATE_PASSWORD	Password for the .p12 file

🤖 Generated with Claude Code