James Stringer e2c578e228 Add macOS Developer ID signing, notarization, and release tooling ...

- xcconfig-based signing: Local.xcconfig (committed) pulls in a git-ignored
  LocalUser.xcconfig for the maintainer's team/Developer ID identity, so the
  public project builds ad-hoc/Personal-Team with no secrets committed.
- Release config in project.pbxproj: Developer ID + hardened runtime +
  secure timestamp + no get-task-allow; arm64; macOS 26 deployment target
  (guest helpers stay 13.0); scheme defaults to Release.
- Version derives from Directory.Build.props via sync-mac-version.sh ->
  version.xcconfig (the same single source of truth Windows uses).
- make-release-mac.sh: build -> verify-sign -> notarize (recursive, covers
  the framework + iso-patch-mac + appsandbox-agent + appsandbox-clipboard) ->
  staple -> Gatekeeper check -> publish a zip-only release_package/.
- Config split mirrors the Windows convention: mac-release-config.json
  (committed, no secrets) + mac-signing.local.json (git-ignored creds).
- tools/sign/SIGNING_MAC.md documents the whole process end to end.

2026-06-01 20:59:29 -04:00

..

AppSandbox.xcscheme

Add macOS Developer ID signing, notarization, and release tooling

2026-06-01 20:59:29 -04:00