Publish free source-built v1.3.0 release

[radwanparvez]

What changed

• Add repeatable user-level source installation and safe uninstallation.
• Publish source-only GitHub releases without unsigned binary attachments.
• Stop uploading ad-hoc CI application artifacts.
• Preserve notarized DMG automation as a manual future workflow.
• Document installation, upgrades, removal, and Quick Look conflicts.

Why

Developer ID signing and Apple notarization require paid credentials. Building
and ad-hoc signing locally provides a safe free distribution path without
presenting an unsigned downloaded application to users.

Validation

• Shell syntax and ordinary project tests passed.
• The installer ran twice successfully.
• The installed signature, bundle identifier, and universal architectures were
  verified.
• The uninstaller removed only the intended user-level application.
• Workflow YAML and Git whitespace checks passed.

The Launch Services integration test remains enforced in GitHub Actions. The
sandboxed local Spotlight service rejected scanning its temporary bundle with
OSStatus -10822.