Notarize releases so macOS opens the app without a warning

Gatekeeper blocked the app on other machines because it was signed but
not notarized. Sign with a secure timestamp and submit to Apple during
release, so a stapled ticket ships in the zip.

💘 Generated with Crush

Assisted-by: Crush:deepseek-v4.1-flash

AGENTS.md

@@ -103,6 +103,13 @@ wants it in the final answer every time. Keep it to the cask upgrade commands
 (see the README release section for the exact block), because the app is
 installed through the tap.
 
+Notarization: `release.sh` submits to Apple when the `SIMPLETOPBAR_NOTARY_*`
+env vars are set (provider, `.p8` path, key id, issuer id). The credentials are
+the same App Store Connect key used by Kapture (`~/.config/kapture/AuthKey_*.p8`,
+team `RX6767S6BW`); the issuer id is a non-secret UUID from App Store Connect.
+Verify with `spctl -a -vv SimpleTopBar.app` → `source=Notarized Developer ID`.
+Without the vars it still builds, zips and prints the sha, just unnotarized.
+
 ## Status item placement (why not MenuBarExtra)
 
 On a full menu bar, a newly created status item is placed leftmost, which on a