[peterj]

Problem

Each macOS architecture compiled the release build twice: once for the standalone binary (cargo build) and once for the PKG (tauri build). On the Intel runner each build takes about 20 minutes.

Changes

• Merge build-macos-binaries and build-macos-installers into one build-macos job.
• Copy the standalone binary out of agentdesktop.app/Contents/MacOS/agentdesktop, re-sign it on its own (same Developer ID, dev.agentdesktop.tray, hardened runtime, timestamp), notarize it, and upload it as release-binary-darwin-<arch> as before.
• PKG notarization, stapling, smoke test and upload are unchanged.
• Update the packaging test, which expected two signing-cleanup steps; there is now one.

Notes

• The standalone binary also gets the release version from the Tauri config, which it didn't before.
• The two binaries are signed the same way but have different signature hashes (CDHash): the app copy's signature also covers Info.plist and the bundle's other files.