Notarize releases so macOS opens the app without a warning

Gatekeeper blocked the app on other machines because it was signed but
not notarized. Sign with a secure timestamp and submit to Apple during
release, so a stapled ticket ships in the zip.

💘 Generated with Crush

Assisted-by: Crush:deepseek-v4.1-flash

build-app.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 cd "$(dirname "$0")"
 
-VERSION="${1:-0.4.7}"
+VERSION="${1:-0.4.8}"
 
 swift build -c release
 
@@ -58,7 +58,7 @@ chmod +x scripts/make-icon.sh
 
 if [ -n "$IDENT" ]; then
     security unlock-keychain "$HOME/Library/Keychains/login.keychain-db" 2>/dev/null || true
-    codesign --force --options runtime --sign "$IDENT" "$APP"
+    codesign --force --options runtime --timestamp --sign "$IDENT" "$APP"
     echo "Built $APP ${VERSION} (signed with Developer ID '$IDENT') — open $APP"
 else
     codesign --force --sign - "$APP"