Fix macOS app notarization and PSD team enforcement

[krishagel]

Summary

• notarize, staple, and validate Atrium Capture.app before placing it in the installer payload
• reuse one notary credential submission path for both the app archive and final package
• require the PSD team ID 87DL7L9GU6 for both Developer ID Application and Installer signatures
• record the resolved team ID in the package manifest

Verification

• zsh syntax and diff checks pass
• unsigned local package build passes and remains supported
• intentional wrong-team distribution build exits non-zero before producing a package
• full pnpm check passes, including 109 Vitest tests, 2 Playwright tests, and 76 Swift tests

Security and distribution impact

This prevents publishing a package signed by the wrong Apple team and ensures offline Gatekeeper verification can use a ticket stapled directly to the app.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.