App self-update and macOS code signing / notarization

[Tryanks]

Status — engineering complete; only your Apple credentials remain (updated 2026-08-25)

Everything automatable is done. What's left is one action only you can take: adding six secrets to the repo.

Shipped:

• In-app update check (PR feat: app update-available check via GitHub releases #255) — checks GitHub Releases for a newer tcode version on the existing provider version-check cadence; a newer release raises a notice + a download row that opens the release page.
• Signing & notarization pipeline (PR ci: Developer ID sign + notarize macOS release builds when configured #269) — the release workflow signs (Developer ID + hardened runtime + entitlements), notarizes, and staples both the app and the DMG whenever six MACOS_* secrets are configured. Absent the secrets it ships unsigned builds exactly as before, so tags never fail to publish. Reviewed for correctness (partial-secret guard, notarytool-log surfacing, trapped keychain teardown, Gatekeeper assertions).

Left to do — needs your Apple Developer account (cannot be automated):

1. Add the six secrets per docs/release-signing.md: Developer ID .p12 (base64), its password, the identity string, Apple ID, Team ID, and an app-specific password. Then a signed release stops needing xattr -dr com.apple.quarantine. Verify with a v0.0.0-signtest prerelease.
2. Windows code signing (optional) — an OV/EV cert would remove SmartScreen friction; the workflow ships unsigned Windows zips today.
3. Self-updating installer (Sparkle-style appcast) — deliberately deferred until signed builds exist; the in-app update-available surface is the entry point for it when built.

Keeping this open as the tracker for the credential step + the two optional follow-ups.