Add code signing, notarization, and DMG packaging scripts

Enables distributing Galaxy.app to end users without Gatekeeper warnings.
Uses Samsung Developer ID Application certificate with hardened runtime.

Pipeline: cargo bundle → sign.sh → notarize.sh → package.sh → Galaxy.dmg

Entitlements:
- network.client (AWS Bedrock API calls)
- automation.apple-events (osascript for CLI install)
- cs.allow-unsigned-executable-memory (Metal shader compilation)

Orchestration scripts:
- build-debug.sh: full pipeline with debug build
- build-release.sh: full pipeline with release build

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

sign.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+set -e
+cd "$(dirname "$0")"
+
+SIGNING_IDENTITY="Developer ID Application: SAMSUNG ELECTRONICS AMERICA, INC. (3JU72Z7Y3J)"
+ENTITLEMENTS="BuildSupport/Galaxy.entitlements"
+
+if [ "$1" = "--release" ]; then
+    APP_PATH="target/release/bundle/osx/Galaxy.app"
+else
+    APP_PATH="target/debug/bundle/osx/Galaxy.app"
+fi
+
+if [ ! -d "$APP_PATH" ]; then
+    echo "Error: $APP_PATH not found."
+    echo "Run first: cargo bundle --bin galaxy-oss --package galaxy"
+    exit 1
+fi
+
+if [ ! -f "$ENTITLEMENTS" ]; then
+    echo "Error: $ENTITLEMENTS not found."
+    exit 1
+fi
+
+JUNK=$(find "$APP_PATH" -maxdepth 1 -not -name "Contents" -not -path "$APP_PATH" 2>/dev/null || true)
+if [ -n "$JUNK" ]; then
+    echo "Removing unsealed items from bundle root: $JUNK"
+    echo "$JUNK" | xargs rm -rf
+fi
+
+echo "Removing .DS_Store files..."
+find "$APP_PATH" -name '.DS_Store' -delete 2>/dev/null || true
+
+echo "Stripping extended attributes..."
+xattr -cr "$APP_PATH"
+
+echo "Signing $APP_PATH..."
+codesign --force --sign "$SIGNING_IDENTITY" \
+    --entitlements "$ENTITLEMENTS" \
+    --options runtime \
+    --timestamp \
+    "$APP_PATH/Contents/MacOS/galaxy-oss"
+
+codesign --force --sign "$SIGNING_IDENTITY" \
+    --entitlements "$ENTITLEMENTS" \
+    --options runtime \
+    --timestamp \
+    "$APP_PATH"
+
+echo "Verifying signature..."
+codesign --verify --strict "$APP_PATH"
+codesign -dvvv "$APP_PATH" 2>&1 | grep -E "Authority|TeamIdentifier|Runtime"
+echo "Architecture: $(lipo -archs "$APP_PATH/Contents/MacOS/galaxy-oss")"
+
+echo ""
+echo "Done. Galaxy.app is signed and ready for notarization."