Code-sign + notarize macOS VST3 release bundles

[grammaton]

Problem

The macOS VST3 bundles shipped in releases (v0.2.0 and earlier) are universal
binaries but unsigned and un-notarized. On a user's machine Gatekeeper
quarantines them, so the first load fails unless the user manually runs:

xattr -dr com.apple.quarantine ~/Library/Audio/Plug-Ins/VST3/<plugin>.vst3

This is a friction point for the pedagogical audience (students just want the
plugin to load in their DAW).

Goal

Sign and notarize the release .vst3 bundles so they load without manual
quarantine removal.

Tasks

• Obtain an Apple Developer ID Application certificate (org or personal).
• codesign --deep --force --options runtime --timestamp each .vst3
  bundle with the Developer ID identity.
• Submit to Apple notary service (xcrun notarytool submit ... --wait).
• xcrun stapler staple the notarization ticket onto each bundle.
• Re-zip with ditto -c -k --keepParent (current packaging convention).
• Verify on a clean machine: spctl -a -vvv -t install <plugin>.vst3 →
  accepted, and the plugin loads with no quarantine warning.
• Automate the sign+notarize+staple step in the release packaging flow
  (script or CI) so future releases ship signed by default.
• Update README install instructions once signing is in place (drop the
  xattr workaround note).

Notes

• The build is already universal (x86_64 + arm64) — see CMakeLists.txt
  arch handling (host-arch default; release builds set
  CMAKE_OSX_ARCHITECTURES explicitly).
• Affects all 10 plugins in the suite; sign them in a loop, same as the
  current zip-packaging loop.
• Linux/Windows builds are out of scope for this issue.