Give the Makefile a target for every build step CI runs - #590

Cover the commands the workflow runs itself, so that each one has a
single definition the Makefile and CI can share rather than two copies
that drift apart.

• Split the dependency build out as deps, the half of pre-build
  that CI needs, having checked out the submodules already
• Add all-tests for the wider test step CI runs today, and let both
  test targets write the result bundle it reads screenshots from
• Add package-signed, exporting where CI wants the app and packing
  the zip it uploads, without archiving a second time to do it

Nothing calls these yet; this only makes the targets able to stand in.
Switching the workflow over is #591, so it can be weighed on its own.

What changes in the target graph

Before:

flowchart TD
  pb["pre-build<br>builds deps inline"] --> gss["git-submodule-sync"]
  ds["dmg-signed<br>packages inline"] --> ar["archive"]
  bp["build-project"] --> ar
  app["app"] --> ar
  dmg["dmg"] --> app
  run["run"] --> build["build"]
  ut["unit-test"]
  uit["ui-test"]

After, with the three new targets shaded:

flowchart TD
  pb["pre-build"] --> gss["git-submodule-sync"]
  pb --> deps["deps"]
  ds["dmg-signed"] --> ar["archive"]
  ds -. "via make" .-> ps["package-signed"]
  bp["build-project"] --> ar
  app["app"] --> ar
  dmg["dmg"] --> app
  run["run"] --> build["build"]
  ut["unit-test"]
  uit["ui-test"]
  at["all-tests"]
  classDef new fill:#E1F5EE,stroke:#0F6E56,color:#04342C
  class deps,ps,at new

Two of the three are extractions rather than new work: deps and package-signed
were already there as inline recipe lines inside pre-build and dmg-signed.
Naming them lets a caller attach below those parents, which is what CI needs,
having checked out the submodules through its own step and built the archive in another.
A CI step calling dmg-signed would archive a second time per architecture.

package-signed hangs off dmg-signed by a dotted edge because it is not a prerequisite:
the recipe calls it through $(MAKE), so it cannot start before the archive has finished
even under make -j.

all-tests is the odd one out, a sibling of ui-test rather than an extraction, and
exists only because CI's test step runs the whole scheme.

The header claimed the targets already mirrored the workflow, which had stopped being true:
ui-test runs only the UI tests while CI's step runs the whole scheme.
It now names which target matches which step, and which one to prefer otherwise.

Two unrelated mistakes in the workflow are fixed along the way, each in its own commit.
Both worked by accident, so neither changes what CI does:

• The signing options were written to a file named after the variable
  holding their path, and read back under that same literal name
• The notarization progress message was handed to tee as two more
  files to write, so it created files named after itself and printed nothing

Test plan:

• make unit-test ARCH=arm64 is green, 42/42
• make all-tests ARCH=arm64 RESULT_BUNDLE=<path> is green and writes the bundle,
  running the unit suites and GitXScreenshotTests
• make -n for deps, archive, package-signed and dmg-signed
  reproduces the commands the matching CI steps run today, with CI's own paths,
  and package-signed runs xcodebuild once rather than archiving again
• The workflow still parses as YAML. The notarization and export
  changes need signing secrets, so they are read rather than run