fix(build): ad-hoc sign the macOS bundle so it is not reported as damaged (#231)

Fixes the shipped v2.5.0 macOS build, which **cannot be opened at all**.
See #230.

Downloading `Driven_2.5.0_darwin_aarch64.dmg` and launching gives:

> "Driven.app" is damaged and can't be opened. You should move it to the
Trash.

## Root cause - not the missing Developer ID

`tauri.conf.json` had no `bundle.macOS.signingIdentity`, and
`release.yml` runs no
`codesign` step, so **nothing ever signed the bundle**. The only
signature was the
linker's, on the executable:

```
flags=0x20002(adhoc,linker-signed)
TeamIdentifier=not set
spctl: code has no resources but signature indicates they must be present
```

No `CodeResources` seal means macOS treats the bundle as damaged. That
is a harder
failure than an ordinary unsigned app: not bypassable by
right-click-Open, and the
dialog actively tells the user to delete it.

## The fix, and its verification on a real artifact

One line: `bundle.macOS.signingIdentity: "-"`. Built locally with the
same
`--config src-tauri/tauri.apfs-helper.conf.json` release.yml uses:

| | shipped v2.5.0 | this PR |
|---|---|---|
| flags | `adhoc,linker-signed` | `adhoc,runtime` |
| Sealed Resources | **absent** | `version=2 rules=13 files=2` |
| `codesign --verify --deep --strict` | fails | **passes** |
| `spctl -a -t exec` | `code has no resources...` | `rejected` |

`rejected` is the CORRECT verdict for an unsigned app, and is the
ordinary
unidentified-developer path the README's Gatekeeper section already
documents. The
`driven-apfs-helper` sidecar is still bundled and is covered by the
seal.

No Apple Developer ID required. Real signing and notarization remain
future work.

## Workaround for anyone on v2.5.0 today

Both commands - stripping quarantine alone leaves the broken seal:

```
xattr -dr com.apple.quarantine /Applications/Driven.app
codesign --force --deep --sign - /Applications/Driven.app
```

## How the release gate missed this, and what should change

The gate tested a **locally built** bundle. A local build is never
quarantined and
never assessed by Gatekeeper, so it verified the app WORKS while never
verifying it
INSTALLS - two different claims. A future gate should run `codesign
--verify --deep
--strict` and `spctl` against the RELEASE artifact, and ideally download
the published
DMG and open it as a user would. Noted in #230.

This warrants a patch release; every macOS user of v2.5.0 is affected.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: pmaxhogan

src-tauri/tauri.conf.json

@@ -71,7 +71,8 @@
     "longDescription": "Driven backs up local folders to Google Drive, one way, fast, with encryption, scheduling, and battery awareness.",
     "publisher": "Driven",
     "macOS": {
-      "minimumSystemVersion": "11.0"
+      "minimumSystemVersion": "11.0",
+      "signingIdentity": "-"
     },
     "windows": {
       "wix": {