Build: Reveal codesign errors when signing contents of VSIX files (macOS)

Currently, we codesign the contents of bootstrapped VSIX files on macOS in a way that discards all output and ignores all errors.

https://github.com/posit-dev/positron-builds/blob/6664980485edd5b756ca341bc9c1f49d9f55b816/.github/workflows/build-prerelease-macos.yml#L352

This has made signature problems difficult to debug, because we can't tell that the signature has failed until later in the build process, when we attempt to notarize the bits and Apple rejects them due to missing signatures. For example:

    {
      "severity": "error",
      "code": null,
      "path": "Positron-2025.04.0-256.dmg/Positron.app/Contents/Resources/app/extensions/bootstrap/posit.publisher-1.12.1.vsix/extension/bin/publisher",
      "message": "The binary is not signed with a valid Developer ID certificate.",
      "docUrl": "https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues#3087721",
      "architecture": "arm64"
    }

The reason that we discard output and ignore errors is that we can't tell which files need to be signed, and attempting to sign a file that doesn't require it (say, a text file) results in errors.

We should fix this by:

• moving the code-signing VSIX step into its own Node script to get access to native tools and better local testability
• using a module like isBinaryFile and/or other detection to determine if a file needs signing
• surfacing signature output and errors
• when a signature fails, throwing a signature error to fail the Node script (and the build)

Start with the VSIX code-signing step in .github/workflows/build-prerelease-macos.yml around line 352 and trace how its output and errors are currently handled. Move that step into a Node script, detect files that need signing, surface signing output, and make signature failures fail the script and build.