fix: don't demand notarization-skip override for App Store builds

[LegalMarc]

Summary

• final_validation() in scripts/sh/build_appstore_release.sh required MARCUT_ALLOW_NOTARIZATION_SKIP=1 whenever SKIP_NOTARIZATION=true, but main() unconditionally forces SKIP_NOTARIZATION=true for any non-Developer-ID (App Store) signing identity, since App Store builds are structurally exempt from notarization (App Review substitutes for it).
• Result: running bash scripts/sh/build_appstore_release.sh standalone for an App Store archive — the documented way to build one — always failed at the final self-check with "Refusing to skip notarization validation without MARCUT_ALLOW_NOTARIZATION_SKIP=1", even though the archive, DMG, and entitlements were all correct.
• Fix: track the App-Store-identity case with its own APPSTORE_IDENTITY_DETECTED flag, so the override is only demanded for an actual unsafe direct-distribution skip (e.g. --skip-notarization passed to a Developer ID build). scripts/sh/build_devid_release.sh's own internal call (which sets MARCUT_ALLOW_NOTARIZATION_SKIP=1 itself) is unaffected either way.

Test plan

• bash -n scripts/sh/build_appstore_release.sh and bash -n scripts/sh/build_devid_release.sh — syntax OK
• Reproduced the bug: bash scripts/sh/build_appstore_release.sh --no-bump (no env override) built and signed everything correctly, then failed non-zero at final_validation
• Confirmed the fix: same command, same identity, now logs "Notarization validation skipped (App Store identity; notarization is not applicable for App Store submissions)" and reaches Build Complete! 🎉 / SUCCESS
• Confirmed the safety case is preserved by inspection: APPSTORE_IDENTITY_DETECTED is only set inside the DEVELOPER_ID != "Developer ID Application"* branch, so a Developer ID build run with --skip-notarization still requires the explicit override

🤖 Generated with Claude Code