Phase 3 tail: desktop security sign-off (notarization, signing certs, cert pin activation)

[ightevenmckane187]

Tracking issue for the remaining desktop security items (all code is merged; these need team-side credentials). Companion to docs/PHASE4_PLAN.md Track A.

Checklist

• Apple Developer Program enrolled → Developer ID Application cert created + exported as .p12 (docs/SIGNING_GUIDE.md §2)
• GitHub secrets added: MAC_CERT_BASE64, MAC_CERT_PASSWORD, APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD, APPLE_TEAM_ID
• Notarization verified end-to-end: xcrun notarytool history shows Accepted for the first release build
• Production gateway has a CA-issued TLS cert (Phase 4 A2) → extract leaf-cert SHA-256 → CIPHERTUBE_CERT_PIN secret set → fail-closed pinning active in release builds
• Gate check: pinned build refuses to load a gateway presenting any other cert (manual mitm test)
• spctl --assess passes on the signed .app

Note: pinning is fail-closed by design — the window never loads the gateway on pin mismatch (desktop/main.js). Windows installers remain unsigned for beta; OV cert optional later.

This was requested as a Jira ticket; Jira is not connected to this workspace, so it is tracked here (GitHub issues #463–#466 precedent).