Document and automate signing/notarization flow for packaged outputs

Goal

Document and automate signing/notarization flow for packaged outputs without mixing signing concerns into runtime implementation.

Scope

• Document the required ordering: package first, sign second.
• Add release docs for macOS codesign + notarization, Windows Authenticode signing, and Linux checksum/signature publishing.
• Add optional CI hooks or release automation scaffolding where appropriate.

Acceptance Criteria

• Release docs cover exact signing order, target artifact shapes, and verification steps.
• The executable packaging issue links to the signing flow docs.
• CI/release automation scope is explicit, even if some credentials are intentionally left for maintainer setup.

Stand-alone Value

Useful release-engineering guidance once executable packaging exists.

Dependencies

Depends on #159.

Tracking

Tracked by #161.

Start with the executable packaging outputs and artifact shapes established by #159, then define the release documentation around package-first, sign-second ordering. Cover macOS codesign and notarization, Windows Authenticode, and Linux checksum/signature publishing, including verification steps and the CI/release automation boundary. Link the finished signing flow from the executable packaging issue and account for #161 tracking.