[bug] v0.8.10 macOS ARM64 release hashes match, but codesign verification fails

### Component

not sure

### What happened?

## Summary

The v0.8.10 macOS ARM64 provider bundle downloads successfully and matches the published release hashes, but local Apple code-signature verification fails for both the app bundle and flat binary. The installer's own bundle test also fails, so I stopped before installing.

## Release metadata checked

Coordinator release endpoint:

- Version: 0.8.10
- Bundle hash: `a4c71f09527c8ff4c29a8759f1787c83a5289be8fe29ee717d2b375031e8c22a`
- Binary hash: `b6e60f586ccd288f43e1afade54d8bca81c67fd88cb8e1d27e1f0f7e29c954de`
- Metallib hash: `08c48889aee7a8d126e47b12528e8f3e2c43f45866de938be11a8777a952b033`

GitHub release advertises the same bundle hash and says signed/notarized.

### Expected behavior

If the release is signed/notarized as advertised, strict codesign verification should pass before install.

### Steps to reproduce

```bash
curl -fsSL https://api.darkbloom.dev/v1/releases/latest -o /tmp/darkbloom-release.json
curl -fL "$(jq -r .url /tmp/darkbloom-release.json)" -o /tmp/darkbloom-bundle-macos-arm64.tar.gz
shasum -a 256 /tmp/darkbloom-bundle-macos-arm64.tar.gz
mkdir -p /tmp/darkbloom-stage
tar xzf /tmp/darkbloom-bundle-macos-arm64.tar.gz -C /tmp/darkbloom-stage
shasum -a 256 /tmp/darkbloom-stage/bin/darkbloom /tmp/darkbloom-stage/bin/mlx.metallib
codesign --verify --strict --verbose=4 -R='anchor apple generic and identifier "io.darkbloom.provider" and certificate leaf[subject.OU] = "SLDQ2GJ6TL"' /tmp/darkbloom-stage/bin/darkbloom
codesign --verify --deep --strict --verbose=4 -R='anchor apple generic and identifier "io.darkbloom.provider" and certificate leaf[subject.OU] = "SLDQ2GJ6TL"' /tmp/darkbloom-stage/Darkbloom.app
```

### Environment

- Hardware: Apple Silicon Mac mini, M4, 32 GB
- macOS: 26.2
- Tailscale/network isolation already set up, but Darkbloom was not installed

### Logs

```shell

```

### Confirmations

- [x] I searched existing issues and this isn't a duplicate

Start by rerunning the release metadata, hash, extraction, and codesign commands provided in the issue on Apple Silicon macOS. Check verification for bin/darkbloom and Darkbloom.app against the published v0.8.10 ARM64 artifact; done means both strict codesign checks pass before installation.

Written by the indexing model from the issue text.