Fix the CI macOS build (still ships broken/bloated DMGs as of v3.3.1)

[jamditis]

Summary

The GitHub Actions build-mac job (npm run electron:build:mac) still produces broken macOS artifacts as of v3.3.1. Confirmed this release: the CI arm64 DMG came out 522 MB and the arm64 -mac.zip 504 MB, versus a healthy ~252 MB — the asar bloat is still present. This has forced a manual local-build-and-upload workaround for every release since v3.3.0, and it blocks shipping the macOS build (see the macOS v3.3.1 issue this links to).

Known defects (from the v3.3.0 release-night investigation)

1. Bloated app.asar. vite outDir: 'dist' collides with electron-builder's output dir dist, and build.files: ["dist/**/*"] sweeps EB's own per-arch output — whichever arch packages second swallows the first arch's finished .app + DMG. Packaging order is why the bloat flips arches between CI and local.
2. Pre-logger SIGKILL on Apple Silicon. CI's ad-hoc-only signing (CSC_IDENTITY_AUTO_DISCOVERY=false) of the dual-arch build leaves node-pty's hardened-runtime signature invalid; the quarantined app is SIGKILLed before logger init, so there is no crash report and zero new log lines. Developer ID signing + notarization repairs it. Same shape as the v2.4.0 regression (Fails to launch #29).
3. Corrupted x64 DMG seal. electron-builder's dmg-builder breaks the nested Electron Framework.framework signature on the x64 DMG image-copy (arm64 OK same run), so the x64 DMG fails notarization even though the loose .app and the zip are valid.

Also load-bearing:

• electron-builder --mac --arm64 does NOT force single-arch — build.mac.target hard-codes arch: [x64, arm64] and EB-26 honors config-arch over the CLI flag (the target arrays must be edited).
• EB-26's builtin notarizer wants APPLE_APP_SPECIFIC_PASSWORD, while scripts/notarize.cjs and CLAUDE.md document APPLE_ID_PASSWORD.

Proposed fix

• True single-arch per-arch CI jobs (separate arm64 and x64 build steps).
• Kill the dist/ collision: move vite outDir, or exclude !dist/mac* !dist/*.dmg !dist/*.zip from build.files.
• Trim !node_modules/onnxruntime-web (renderer-only, already copied to dist/vad).
• Reconcile the notary env-var name (APPLE_APP_SPECIFIC_PASSWORD vs APPLE_ID_PASSWORD).
• Add a mandatory per-DMG codesign --verify --deep --strict + stapler validate gate so a broken image can't silently ship.

Acceptance criteria

• CI produces arm64 and x64 DMGs at healthy sizes (~250-265 MB)
• Both CI DMGs pass codesign --verify --deep --strict and stapler validate
• arm64 DMG launches from quarantine on Apple Silicon (no pre-logger SIGKILL)
• The manual local-build workaround is no longer needed for releases

[jamditis]

Blocks #46 — the macOS v3.3.1 build can't ship from CI until this is fixed; until then it's done by the local-build workaround in #46.