Fix release signing pipeline and stop advertising the app as unsigned

[royalbhati]

Why

Two problems found while auditing why installs are low.

1. The release workflow could ship an unsigned build.

release.yml built with CODE_SIGN_IDENTITY="-" (ad-hoc) and published the result on any v* tag push. Shipped 1.4.0 is properly notarized, so something outside CI produced it — but the workflow remains a live trap: the next scripts/release.sh run pushes a tag, CI builds ad-hoc, and release.sh then points the Homebrew cask at whatever CI produced.

2. The README told every visitor the app was unsigned.

Verified against the shipped 1.4.0 binary:

Authority=Developer ID Application: ZFUNDS DISTRIBUTION PRIVATE LIMITED (GP4Y23ZTR6)
spctl: accepted — source=Notarized Developer ID
stapler validate: The validate action worked!

The README still said "HopTab is ad-hoc signed (not notarized)" and gave two xattr commands to bypass Gatekeeper — the scariest possible framing immediately before asking for Accessibility permission. The notarization work was done and the trust penalty was still being paid.

What changed

Release pipeline

• Fails fast if signing secrets are missing, instead of silently falling back to ad-hoc
• Imports the Developer ID cert into a throwaway keychain, cleaned up on exit
• Builds with hardened runtime + secure timestamp
• Notarizes via notarytool and staples the ticket
• Gates publishing on spctl reporting source=Notarized Developer ID

CI

• build.yml now runs the 100 HopTabPro tests, which CI never executed
• Also runs on pushes to main, not just PRs

Docs

• README: both xattr commands and the not-notarized note removed
• release.yml release-notes template: same fix, plus the Homebrew one-liner
• hoptab.rb: stale root copy synced 1.2.0 → 1.4.0 to match the real tap
• .gitignore: internal strategy docs and local demo recordings

Before merging

The release job needs these secrets, or every release will now fail (deliberately — that's the point):

Secret	What
MACOS_CERT_P12_BASE64	Developer ID Application cert, .p12, base64
MACOS_CERT_PASSWORD	password for that .p12
APPLE_ID	Apple ID for notarization
APPLE_APP_SPECIFIC_PASSWORD	app-specific password, not the account password

Team ID GP4Y23ZTR6 is set inline in the workflow.

Worth reconciling how 1.4.0 actually got signed before cutting 1.5 — if it was a manual Xcode archive, this workflow replaces that step.