chore(desktop-client): add macOS code-signing and notarization scaffolding

- Move the build config out of package.json into electron-builder.yml so
  the mac block can carry hardenedRuntime, entitlements, universal arch,
  and usage-description Info.plist keys. Drop identity:null (which
  forces unsigned builds) and let CSC_NAME or the keychain decide.
- Add entitlements plist files and three helper scripts: sign-setup.sh
  (one-time keychain prep with notarytool store-credentials),
  sign-mac.sh (sign + notarize + staple, supports keychain or CI env
  vars), and ci-import-cert.sh (CI keychain bootstrap).
- Ignore .env.signing so local credentials don't sneak into the repo,
  and pin @emnapi/{core,runtime} as devDependencies so universal builds
  resolve them deterministically.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/electron-builder.yml

@@ -35,18 +35,25 @@ files:
   - "!**/node_modules/**/*.{c,cc,cpp,h,hpp,cmake,m4,am,sh}"
 mac:
   category: public.app-category.productivity
-  identity: null
-  notarize: false
-  hardenedRuntime: false
+  # identity 不写死：让 electron-builder 自动从 CSC_NAME 环境变量或钥匙串里挑
+  # 注意：写 `identity: null` 是"明确不签名"，不要这么写
+  notarize: false             # 我们用 notarytool 自己跑，比 electron-builder 内置更稳
+  hardenedRuntime: true
   gatekeeperAssess: false
+  entitlements: build/entitlements.mac.plist
+  entitlementsInherit: build/entitlements.mac.inherit.plist
   electronLanguages:
     - en
     - zh_CN
+  extendInfo:
+    NSCameraUsageDescription: 用于视频会议和录屏功能
+    NSMicrophoneUsageDescription: 用于音频采集
+    NSAppleEventsUsageDescription: 用于自动化控制其他应用
   target:
     - target: dmg
-      arch: [arm64]
-    - target: zip
-      arch: [arm64]
+      arch: [arm64, universal]
+    # - target: zip
+    #   arch: [arm64, universal]
 dmg:
   format: ULFO
   contents: