darwin builds are born with an invalid signature -- add mandatory codesign step to build/release #67

Found 2026-07-16 diagnosing the Mac's mcp2cli dying with SIGKILL (exit 137, zero output, even --version) since the Jul 5 build.

Root cause: bun build --compile on macOS arm64 injects the JS bundle into the Mach-O after the linker signs it, so the ad-hoc signature is invalid from birth. AMFI kills the binary at exec. codesign --verify reports invalid signature (code or signature have been modified). Linux cross-compiles are unaffected.

Fix: wherever darwin binaries are produced (release CI, docs, local build instructions), add a mandatory post-build step:

codesign --force -s - dist/mcp2cli-darwin

Verified: re-signing the dead Jul 5 binary AND a fresh 0.3.15 build both go from exit 137 to working immediately.

Cross-ref: rtech-infra GOTCHAS.md entry 2026-07-16.