Code signing + notarization for macOS and Windows

[packetThrower]

macOS users currently see "unidentified developer" warnings on first launch. Windows users hit SmartScreen. Both can be fixed with paid certs.

• macOS: Apple Developer ID ($99/yr). Tauri 2 has docs for signing + notarizing in CI. Notarization needs an app-specific password as a secret.
• Windows: code-signing cert ($300+/yr). EV certs give immediate SmartScreen reputation. Cloud signing services (DigiCert KeyLocker, Azure SignTool) avoid shipping a hardware token to CI.

Steps:

1. Acquire certs
2. Add secrets to GitHub Actions
3. Configure tauri.conf.json and the release workflow
4. Re-test the v3.1.x flow

Biggest UX issue right now — first-time install friction is high without this.