feat(release): sign + notarize with fork Developer ID

Set the fork Developer ID in config/local.xcconfig (Manual style + team), re-sign the vendored Sparkle helpers under it, and import the cert with an optional APPLE_P12_PASSWORD. Built, signed, and notarized (Accepted) locally before cutting.

.github/workflows/ci_cd.yml

@@ -30,6 +30,9 @@ env:
   APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
   APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
   APPLE_P12_CERTIFICATE: ${{ secrets.APPLE_P12_CERTIFICATE }}
+  # alt-tab-free [depaywall]: optional .p12 export password (empty if exported password-less).
+  # Not part of the release-gate AND — the cert import tolerates an empty password.
+  APPLE_P12_PASSWORD: ${{ secrets.APPLE_P12_PASSWORD }}
   SPARKLE_ED_PRIVATE_KEY: ${{ secrets.SPARKLE_ED_PRIVATE_KEY }}
   GITHUB_EVENT_BEFORE: ${{ github.event.before }}
   GITHUB_EVENT_AFTER: ${{ github.event.after }}

config/local.xcconfig

@@ -43,11 +43,13 @@ DOMAIN = fork.invalid
 API_DOMAIN = fork.invalid/api
 
 // --- Code signing (overrides release.xcconfig :5) ---
-// TODO: fork Developer ID — set to the fork's own signing identity, e.g.
-//       CODE_SIGN_IDENTITY = Developer ID Application: <Fork Org> (TEAMID)
-//       Required for notarization/Gatekeeper. Also re-sign vendored Sparkle helpers
-//       under this same Developer ID (§3.3 / §4.6) or notarization rejects.
-// CODE_SIGN_IDENTITY = Developer ID Application: <Fork Org> (TEAMID)
+// Fork Developer ID — signed, notarizable builds (PLAN §3.3 / §4.6). Set 2026-06-16.
+// The vendored Sparkle helpers (vendor/Sparkle/Helpers/*) are re-signed under this SAME
+// identity (a committed change) — required or notarization rejects the nested code.
+// Manual style + TEAM_ID so the headless CI runner signs without an Xcode-managed account.
+CODE_SIGN_IDENTITY = Developer ID Application: James Maes (2X834TJ5MA)
+CODE_SIGN_STYLE = Manual
+TEAM_ID = 2X834TJ5MA
 
 // --- Telemetry off (overrides base.xcconfig; AppCenter no-ops on empty secret) ---
 // Intentionally empty: telemetry is disabled (reinforced by Edit 3, §2).

scripts/codesign/setup_ci_master.sh

@@ -7,4 +7,4 @@ certificateFile="codesign"
 # Recreate the certificate from the secure environment variable
 echo "$APPLE_P12_CERTIFICATE" | base64 --decode > $certificateFile.p12
 
-scripts/codesign/import_certificate_into_new_keychain.sh "$certificateFile" ""
+scripts/codesign/import_certificate_into_new_keychain.sh "$certificateFile" "${APPLE_P12_PASSWORD:-}"