ci: Sign macOS release binaries (#12811)
- Signs and notarizes macOS release binaries before they are uploaded
for npm publishing.
- Uses static Apple signing secrets with pinned
`apple-codesign`/`rcodesign`, matching the standalone binary release
strategy.
- Documents the required GitHub secrets for release operators.
