U8: Package and operate the macOS helper

[blackforestboi]

Implements U8 of the implementation plan.

Depends on U7. Ship the LaunchAgent, install/upgrade/rollback/uninstall, verified Codex bootstrap, attention and reconciliation commands, actionable status, redacted diagnostics, signing, notarization, checksums, SBOM, and provenance.

Requirements: R2, R13-R15. Exit: clean supported macOS machines pass lifecycle and release verification without leakage.

[blackforestboi]

The macOS release-engineering foundation landed on main in #11. It now includes universal Swift builds, hardened-runtime Developer ID Application signing, timestamped Developer ID Installer packaging, notarytool submission and logs, stapling, Gatekeeper verification, checksums, SPDX SBOM generation, GitHub attestations, immutable releases, and a protected macos-release environment restricted to v* tags.

The environment is deliberately gated with MACOS_RELEASES_ENABLED=false. Before the first real release, add the documented application/installer .p12 secrets and App Store Connect notary key values, complete U0/product implementation, run a live notarization rehearsal, then enable releases. The rest of U8 (full install/upgrade/rollback/uninstall and clean-machine lifecycle verification) remains open.