Publish versioned, signed, and notarized macOS releases

[VirtualPaul]

Summary

The repository does not currently provide a verifiable macOS release artifact. The checked-in installer changes while its version remains 0.1.0, and the package is unsigned/not notarized, so macOS rejects it under standard trust assessment.

Tested against main at fb265549480ff0d3ad8b14b28007370539b70cf3.

Evidence

• packaging/build-pkg:5 defaults every build to 0.1.0.
• The installed pre-upgrade and post-upgrade payloads had different SHA-256 hashes, but both receipts reported version 0.1.0.
• The repository currently has no tags, GitHub Releases, or release workflow.
• pkgutil --check-signature dist/TokenMeter-0.1.0.pkg reports no signature.
• spctl -a -vv -t install dist/TokenMeter-0.1.0.pkg rejects it with source=no usable signature.
• The bundled menubar binary is ad-hoc signed and has no TeamIdentifier.

Impact

Users cannot determine which build is installed, package managers cannot compare versions reliably, rollback/provenance is unclear, and default macOS trust controls cannot validate the installer.

Suggested fix

1. Use a tag-derived semantic version as the single source of truth; fail release builds if it is absent or differs from package metadata.
2. Sign the menubar binary with Developer ID Application and the package with Developer ID Installer.
3. Notarize and staple the package.
4. Build release artifacts in CI from a protected tag and attach the .pkg, SHA-256 checksum, and build provenance to a GitHub Release.
5. Stop replacing a same-version binary in dist/, or make it clearly a development snapshot with a unique build version.
6. Document verification and rollback commands.

Acceptance criteria

• Package receipt version equals the release tag and increases when payload changes.
• codesign -dv shows the expected TeamIdentifier.
• pkgutil --check-signature reports a valid Developer ID chain.
• spctl -a -vv -t install accepts the stapled package on a clean supported macOS host.
• Release checksums match the downloaded artifacts.