ci(github): verify notarized release DMGs

[santosli]

Summary

• Submit the generated universal DMG to Apple notarization and require Accepted.
• Staple the ticket before DMG verification, release upload, and checksum generation.
• Add DMG-level codesign, xcrun stapler validate, and spctl --assess --type open gates while retaining mounted app checks.
• Document the DMG-level distribution boundary and add a release workflow contract test.

Verification

• node --test scripts/release.test.js
• npm test (261/261)
• Ruby YAML parse of .github/workflows/release.yml
• git diff --check

Release safety

The workflow still publishes only on tag pushes. The requested branch dry run uses workflow_dispatch and does not create a release or update Homebrew.