Part of the Godot→Flutter migration (#79). Required for a frictionless public download, and a hard dependency for seamless desktop self-update.

Problem

The release artifacts from .github/workflows/release.yml are unsigned:

• macOS (daccord-macos-universal.dmg) — Gatekeeper blocks unsigned/unnotarized apps ("can't be opened because Apple cannot check it"). Self-update can strip quarantine, but first install is still hard-blocked for normal users.
• Windows (daccord-windows-x86_64-setup.exe / .zip) — SmartScreen shows an "unrecognized app" warning; reputation only builds with a signing cert.

What's needed

• macOS: Developer ID signing + notarization + stapling in the release workflow (needs Apple Developer account + secrets).
• Windows: Authenticode code signing of the installer + exe (needs a code-signing certificate; consider EV/Azure Trusted Signing for instant SmartScreen reputation).
• Store signing secrets in repo/org secrets and wire into release.yml.
• (Linux: no signing needed; optionally provide checksums/GPG sigs for the artifacts.)

Acceptance

Fresh downloads on macOS and Windows open without security blocks, and the self-update flow ([desktop self-update issue]) installs signed binaries.

Migrated from DaccordProject/daccord-app#83