fix(release): make the Portal macOS package actually build and ship signed

Three defects in a path that had never run end to end. Found by running
scripts/package-macos-client.sh locally rather than one CI dispatch at a time.

`portal-dist` is src-tauri/build.rs output and is deliberately not committed,
but `cargo tauri build` validates frontendDist before cargo runs any build
script, so on a clean checkout the directory never exists when tauri looks for
it. Every Portal job failed with "Unable to find your web assets". It only
worked on a developer machine because an earlier build had left the directory
behind. Run `cargo check -p portal` first, which executes the build script and
writes the payload.

The .app was never signed. The script asserts `Signature=adhoc` and relies on
"the linker's ad-hoc signature", but that covers only the Mach-O; the bundle had
no _CodeSignature, so `codesign --verify --deep --strict` failed with "code has
no resources but signature indicates they must be present".

Signing has to happen during bundling, not after. The DMG is built from the
.app, so signing the .app once the DMG already exists would publish a DMG
containing an unsigned bundle -- which arm64 macOS refuses to execute, and which
none of the existing assertions would have caught, because they inspect the .app
and only checksum the DMG. Export APPLE_SIGNING_IDENTITY=- for the ad-hoc build.
`-` is the ad-hoc pseudo-identity rather than an Apple credential, so the guard
that refuses real credentials in ad-hoc mode still means what it says.

Verified locally from a clean bundle directory: the script exits 0 and emits
client_signing=adhoc with all three assets, and the app *inside the mounted DMG*
passes `codesign --verify --deep --strict` reporting Signature=adhoc, no
authority chain, and no TeamIdentifier.

commit

d548572a3110f017d0e1146a3ed79c5a076834bb

parent

86cb5c2723b2b2e2aa1d74d1a389c3b4885aa42a

author

Dami <dami.etoile@gmail.com>