build: add macOS arm64 release pipeline

[Astro-Han]

Summary

• add one manual GitHub Actions workflow that builds only the Apple Silicon macOS DMG
• keep packaging and final-artifact verification in reusable repository scripts
• sign, notarize, staple, verify, and upload a draft GitHub Release before manual publication
• pin the bundled OfficeCLI input digest, exclude non-product test output, and ship the required distribution notices
• verify the packaged PTY, filesystem worker, renderer AppShell, architecture, signing, notarization, and forbidden Computer Use resources

Verification

• npm run format:check
• npm run lint
• actionlint .github/workflows/release-macos-arm64.yml
• npm run test:scripts (146 passed)
• all workspace test suites passed outside the restricted sandbox; desktop: 2854/2854, runtime: 2547 passed + 7 skipped, CLI: 652/652, runtime-host: 161/161
• npm run build
• npm run typecheck
• npm audit --omit=dev --audit-level=high (no high/critical findings; two moderate Windows-specific findings)
• downloaded OfficeCLI v1.0.63 and matched the repository-pinned darwin-arm64 SHA-256
• built a real unsigned arm64 DMG and verified its license payload and absence of compiled __tests__
• after applying temporary ad-hoc-only local entitlements, the packaged app passed PTY, filesystem-worker, and renderer AppShell smoke checks

The production Developer ID signature, Apple notarization, stapling, Gatekeeper assessment, and draft release upload are intentionally verified by the manual release workflow because those credentials exist only in the protected release environment.