build(desktop): enable macOS signing & notarization for release

desktop/package.json

@@ -44,6 +44,7 @@
   "build": {
     "appId": "com.cowagent.desktop",
     "productName": "CowAgent",
+    "afterPack": "build/sign-backend.js",
     "directories": {
       "output": "release"
     },
@@ -67,6 +68,11 @@
     "mac": {
       "category": "public.app-category.productivity",
       "icon": "resources/icon.icns",
+      "hardenedRuntime": true,
+      "gatekeeperAssess": false,
+      "entitlements": "build/entitlements.mac.plist",
+      "entitlementsInherit": "build/entitlements.mac.plist",
+      "notarize": true,
       "target": [
         {
           "target": "dmg",