Add connect-on-launch and notarized desktop release packaging

AGENTS.md

@@ -76,7 +76,9 @@ what we take vs. skip). Never vendor it into the build.
   needs CGO). It runs the same `internal/client` service in-process and uses
   `~/.config/tunnel/config.json`. If the CLI service is already running, stop
   it first — the app shows a banner and offers to stop it. `--autostart`
-  connects on launch. On macOS, `scripts/build-desktop-app.sh <version>` builds
+  connects on launch; Settings has **Connect on launch** for the same behavior
+  when opened normally. Add the app to macOS Login Items for start-at-login.
+  On macOS, `scripts/build-desktop-app.sh <version>` builds
   and ad-hoc signs `Tunnel.app`; the installed copy is
   `~/Applications/Tunnel.app`. Cross-OS builds need that OS's CGO toolchain;
   `CGO_ENABLED=0` does not work for Fyne.