Ship the release dmg and zip with their notarization stapled - #655

Fixes #650.

Neither release artifact carries a stapled notarization ticket. Measured on the
published 1.5.7 assets:

$ xcrun stapler validate GitX-arm64.dmg
GitX-arm64.dmg does not have a ticket stapled to it.

Stapling is what lets Gatekeeper answer out of the download itself. Without a
ticket it has to ask Apple at first launch, so a machine that cannot reach the
service has nothing to fall back on. That is Apple's stated reason for the step,
rather than something measured here.

The steps ran in an order that threw the stapling away: make package-signed
built the dmg and zip, notarization then ran against a separate GitX.zip, and
the stapler updated GitX.app and that second zip. Nothing uploads the second
zip. The two files that ship were sealed one step before the ticket existed.

Changes

• Split export-signed out of package-signed, so exporting the app and
  packaging it can sit either side of notarization
• Package the dmg and zip after Staple Notarization, from the stapled app
• dmg-signed runs both, so building a signed image locally is unchanged

What this PR's CI does not tell you

Every step this change touches is gated on secrets.BUILD_CERTIFICATE_BASE64,
which a pull request from a fork does not get. On the run for this PR they are
all reported as skipped:

skipped   Prepare artifact
skipped   Notarize App
skipped   Staple Notarization
skipped   Check Notarization
skipped   Package the stapled app

So the green checks here mean the project still builds, and nothing about the
fix. It can only be confirmed by a run on master, where the secrets exist.

Test plan

The signing half cannot run outside CI, so the packaging half was measured
locally on an unrelated stapled application renamed to GitX.app, driven
through the real make package-signed recipe:

• make -n confirms package-signed no longer runs exportArchive, so the
  second call cannot overwrite the stapled app
• Workflow YAML parses, and the step order is export, notarize, staple, check,
  package, upload

The new step ends with xcrun stapler validate GitX.app, so a future change
that reintroduces the ordering fails the job rather than shipping quietly.

After this lands, the check on the next release asset is:

xcrun stapler validate GitX-arm64.dmg

Not covered: the dmg file itself still carries no ticket of its own. I tested
that, and a dmg built from a stapled app is not itself stapled, because tickets
are keyed to what was submitted. Stapling it needs the dmg notarized as well,
which is a second round trip and a larger change; the app inside it is stapled,
which is what a user runs.