build(macos): Notarize the DMG and drop its license prompt; v0.1.1

Claude-Session: https://claude.ai/code/session_01B65qLEKnkeYTGdbwhLpjCu

.github/workflows/release.yml

@@ -117,6 +117,19 @@ jobs:
           releaseId: ${{ needs.create-release.outputs.release_id }}
           tagName: ${{ env.TAG }}
           args: --target ${{ matrix.target }}
+      # tauri-action notarizes the .app but not the DMG around it; notarize and
+      # staple the DMG too, then replace the uploaded asset.
+      - name: Notarize DMG
+        if: runner.os == 'macOS' && env.APPLE_ID != ''
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          for dmg in target/${{ matrix.target }}/release/bundle/dmg/*.dmg; do
+            xcrun notarytool submit "$dmg" --apple-id "$APPLE_ID" --password "$APPLE_PASSWORD" \
+              --team-id "$APPLE_TEAM_ID" --wait
+            xcrun stapler staple "$dmg"
+            gh release upload "$TAG" "$dmg" --clobber
+          done
 
   publish:
     needs: [create-release, build]