Codesign and notarize fallout-agent macOS binary

Parent: #122

The macOS `fallout-agent` binary is codesigned with Developer ID Application, notarized via `notarytool`, and stapled — so Gatekeeper allows it without operator intervention.

## Definition of done

- Hardened runtime enabled (`--options=runtime`).
- Signed with a Developer ID Application certificate; identity stored in repo secrets (cert + password).
- Notarized via `xcrun notarytool submit --wait`; Apple ID / Team ID / app-specific password sourced from repo secrets.
- `xcrun stapler staple` applied to the binary (or to the bottle archive, whichever Homebrew expects — confirm during implementation).
- `spctl --assess --type execute` passes on a freshly downloaded bottle on a clean macOS VM.
- Custody / rotation plan for the Developer ID cert + app-specific password is captured (link from the umbrella issue).