fix(ci): sign macOS Mach-O natives embedded in bundled jars before notarization

The v1.12.2 release was the first to actually codesign + notarize the macOS
artifacts (signing was wired after v1.12.1, which shipped unsigned). Both macOS
legs failed with "Notarization status: Invalid": Apple's notary service recurses
into the bundled jars and rejects the unsigned Mach-O natives inside them
(secp256k1, sqlite-bundled, jna, skiko, jkeychain, kdroidFilter mediaplayer) —
codesign on the .app and the CLI's loose-file loop never descend into jars.

Notary log confirmed the offending entries, e.g.
  sqlite-bundled-jvm.jar/natives/osx_arm64/libsqliteJni.dylib
    -> "not signed with a valid Developer ID certificate" / "no secure timestamp"

Add scripts/sign-macos-jar-natives.sh: a shared helper that signs every macOS
Mach-O inside the bundled jars with hardened runtime + a secure timestamp,
skipping Linux ELF via a `file` Mach-O gate and no-opping when no identity is
set (local/PR builds unchanged). Wire it into:
  - the CLI notarize step (runs before the loose-file signing loop)
  - a desktop signMacJarNatives Gradle task that signs the proguarded jars
    between proguardReleaseJars and createReleaseDistributable, so Compose
    seals already-signed code.

Validated locally on arm64: clean signed createReleaseDistributable produces an
.app that passes `codesign --verify --deep --strict`, with every nested native
carrying Developer ID + hardened runtime + secure timestamp.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/create-release.yml

@@ -326,7 +326,12 @@ jobs:
           set -euo pipefail
           IMG="cli/build/amy-image/amy"
           ENTITLEMENTS="cli/packaging/macos/amy.entitlements"
-          # Sign every Mach-O binary in the bundled JRE. Each is signed
+          # First sign the macOS Mach-O natives buried INSIDE the bundled jars
+          # (secp256k1/jna/sqlite/skiko/jkeychain/mediaplayer). The loose-file
+          # loop below can't see them, but Apple's notary recurses into jars and
+          # rejects any unsigned Mach-O — so this must run before notarize.
+          SIGN_IDENTITY="$SIGN_IDENTITY" scripts/sign-macos-jar-natives.sh "$IMG"
+          # Sign every loose Mach-O binary in the bundled JRE. Each is signed
           # independently (no enclosing .app seals them), so order is irrelevant.
           # Executables get the hardened-runtime entitlements; dylibs don't.
           while IFS= read -r f; do
@@ -341,10 +346,10 @@ jobs:
           done < <(find "$IMG" -type f)
           codesign --verify --strict --verbose=2 "$IMG/runtime/bin/java"
           # Notarize: zip the signed image, submit, wait for Apple's verdict.
-          # The notary service recursively inspects the lib/*.jar files, so any
-          # unsigned Mach-O embedded in them (secp256k1/jna/sqlite/skiko natives)
-          # can come back Invalid. Surface the per-file log so the first real run
-          # is diagnostic rather than a bare failure.
+          # The notary service recursively inspects the lib/*.jar files; their
+          # embedded Mach-O natives are signed by sign-macos-jar-natives.sh
+          # above. Surface the per-file log on any non-Accepted verdict so a
+          # regression is diagnostic rather than a bare failure.
           ZIP="$RUNNER_TEMP/amy-notarize.zip"
           OUT="$RUNNER_TEMP/notary-submit.json"
           ditto -c -k --keepParent "$IMG" "$ZIP"