Prepare Ledge for open-source distribution

[aramr]

What changed

• adds MIT licensing, contribution, conduct, security, issue, and pull request documentation
• adds signed and notarized Developer ID packaging, GitHub Release automation, artifact attestations, Homebrew Cask generation, and Sparkle updates
• pins GitHub Actions by commit SHA and adds CI, Dependabot, and generated release-note configuration
• includes the current timer/media side-bubble behavior, Calendar refresh improvements, and associated regression tests
• separates Debug and Release bundle identifiers and establishes version 1.0.0 / build 1

Why

Ledge needs a reproducible, secure path for open-source GitHub distribution through direct downloads, in-app updates, and Homebrew while preserving the current application behavior for hands-on testing before a public release.

Release-signing fix

The initial notarization test showed that xcodebuild archive left Sparkle's nested updater helpers signed by the upstream project without our Developer ID timestamp. The release build now performs a developer-id archive export, which re-signs Sparkle's updater and XPC services with the Ledge team. Distribution verification explicitly checks every nested helper's Developer ID authority, timestamp, Hardened Runtime, and Team ID.

Validation

• Scripts/ci.sh
• all unit and regression tests passed
• universal arm64 + x86_64 Developer ID archive and export passed
• Apple notarization accepted both the app and DMG
• app and DMG stapling passed
• Gatekeeper reported Notarized Developer ID
• Sparkle appcast generation and EdDSA signing passed
• release checksums verified
• Homebrew Cask style and strict audit passed
• credential/private-key scan passed

This PR intentionally does not create a tag or publish a public release. It remains a draft while the app is tested manually.