[Bare7a]

📝 What changed?

Releases now sign the macOS app with the Developer ID, have Apple notarize it and staple the tickets, so it opens without the trip to Privacy & Security. A release fails rather than ship an un-notarized app. Every file a release publishes gets a build provenance attestation. The README, landing page and contributing docs are ready for the launch, and the site gains a privacy policy.

🧩 Type of change

• 🐛 Bug fix
• ✨ Feature
• ♻️ Refactor
• ⬆️ Dependencies
• 📝 Docs or landing page
• 🛠️ Build, CI or packaging

🧪 Tested

• By hand on Windows
• By hand on macOS
• By hand on Linux
• Tests workflow on macOS and Windows

📖 Docs

• Updated the guide
• Updated the README or landing page
• No docs needed

📌 Notes

• Tested on macOS: the packaging script's ad-hoc path still builds both zips and the dmg. A copy signed with the hardened runtime starts, answers MCP, and loads a SQLite extension only with the new entitlement. Both site pages work in a browser with no console errors.
• A release of Bare7a/BarSQL now fails without those secrets. Forks and build-only runs still sign ad-hoc.
• The README now describes a notarized Mac app and attested files, which become true with the first release after this merges. Master is already at 1.2.5, so tag v1.2.5 as it is.