Add macOS Gatekeeper smoke tests for Electron release artifacts

While investigating konard/vk-bot-desktop#6, I compared related CI/CD workflows and found the Deep SDK Electron macOS release path has the same class of risk: macOS artifacts can be uploaded without a CI check that proves a downloaded app passes Gatekeeper.\n\nObserved in .github/workflows/build-and-publish-reusable-workflow.yml:\n\n- mac-arm64 and mac-x64 builds set CSC_KEY_PASSWORD, but CSC_LINK and Apple notarization credentials are commented in the build step.\n- The workflow uploads the produced .app.zip without running hdiutil/codesign/spctl/stapler validation.\n- There is no post-build smoke test that copies the app as a user would after download and checks Gatekeeper assessment.\n\nWhy this matters:\n\nElectron and Apple docs recommend signing and notarizing macOS apps distributed outside the App Store. Without that, a downloaded artifact can be blocked by macOS with messages such as "is damaged and can't be opened" or related Gatekeeper warnings, even when the build completed successfully.\n\nReproduction/check:\n\n1. Run the mac-arm64 or mac-x64 build workflow.\n2. Download the produced mac artifact on a clean macOS machine, or add a CI smoke-test step after build.\n3. Validate the app with commands like:\n\n```sh\ncodesign --verify --deep --strict --verbose=2 path/to/App.app\nspctl --assess --type execute --verbose=4 path/to/App.app\nxcrun stapler validate path/to/App.app\n```\n\nSuggested fix:\n\n- Pass the certificate and notarization secrets into the Electron build step instead of leaving them commented.\n- Enable hardened runtime and notarization in Electron Builder config.\n- Fail the release job when required macOS signing/notarization secrets are missing, rather than uploading a mac artifact that users may not be able to open.\n- Add a post-build smoke test that extracts or copies the app and runs codesign, spctl, and stapler validation before upload.\n\nWorkaround until fixed:\n\nPublish only artifacts that pass local codesign/spctl/stapler validation, and document manual xattr/Gatekeeper bypasses only as a temporary unsupported workaround for test builds.