Sign and notarize macOS CLI builds

macOS now runs the TofuPilot CLI without Gatekeeper blocking it, so downloaded builds launch without the "cannot be opened because the developer cannot be verified" warning.

• Signed the macOS CLI binary for both Apple Silicon and Intel with a new Apple Developer ID certificate
• Notarized every build with Apple so it passes Gatekeeper checks on first run