Fold signed macOS client packaging into main release workflow

[Copilot]

Release publishing did not guarantee macOS client artifacts in the same build graph as Linux/Windows client outputs. This change makes client release packaging explicitly tri-platform (Linux, Windows, macOS signed/notarized) within release.yml.

• Workflow topology

  • Added build-client-mac to .github/workflows/release.yml.
  • github-release now depends on build-client-mac and gates release creation on its success|skipped result, aligning with existing Linux/Windows client gates.

• macOS signing/notarization in main flow

  • Runs on [self-hosted, macOS].
  • Imports mac signing cert into a temporary keychain.
  • Uses Apple API key credentials for notarization during electron-builder --mac --publish never.

• Artifact unification

  • Uploads mac client artifacts from the new job into the shared release artifact set:
    • *-mac-*.dmg
    • *-mac-*.zip
    • *-mac-*.zip.blockmap
    • latest-mac.yml

build-client-mac:
  if: ${{ needs.prepare.outputs.build_client == 'true' }}
  runs-on: [self-hosted, macOS]
  needs: prepare

github-release:
  needs: [prepare, build-sfu, build-server, build-client-linux, build-client-windows, build-client-mac]
  if: >-
    ... &&
    (needs['build-client-mac'].result == 'success' || needs['build-client-mac'].result == 'skipped')