fix(release): stabilize fork macOS update identity

[saphid]

Summary

• pin PR feat(desktop): support custom update release sources pingdotgg/t3code#8976 to the stable macOS update-signing implementation
• build credential-free fork artifacts with a stable bundle-identifier requirement
• reject build-specific cdhash requirements before publishing
• document the credential-free and Developer ID signing paths

Verification

• downstream Nightly assembler tests: 14 passed
• clean replay from upstream v0.0.38-nightly.20260901.1250 succeeded
• local arm64 fork ZIP passed deep codesign verification
• local independently built fork ZIP satisfied the stable designated requirement
• focused packaging and signing tests passed
• scripts typecheck and targeted check passed