Design the future protected release workflow for signed binary downloads.\n\nAcceptance criteria:\n- Release workflow is protected from fork PRs.\n- Developer ID signing and notarization secrets are not available to PR CI.\n- Output includes app zip, SHA256 checksum, and commit SHA in release notes.\n- Gatekeeper validation step is documented.
Design the future protected release workflow for signed binary downloads.\n\nAcceptance criteria:\n- Release workflow is protected from fork PRs.\n- Developer ID signing and notarization secrets are not available to PR CI.\n- Output includes app zip, SHA256 checksum, and commit SHA in release notes.\n- Gatekeeper validation step is documented.