Ensure OpenJarvis executables pass security checks

Related discussion: https://github.com/open-jarvis/OpenJarvis/discussions/622

Ensure every official desktop release artifact is signed using the appropriate platform mechanism, verified during CI, scanned before publication, and accompanied by clear verification instructions.

Acceptance criteria

• Document the signing and verification status of every release artifact.
• Windows executables and installers use Authenticode with a trusted certificate and timestamp.
• macOS applications are signed with Developer ID, use the hardened runtime where applicable, and pass Apple notarization and stapling checks.
• Linux packages and AppImages have an appropriate verifiable package or detached signature.
• CI verifies every expected signature and fails the release if an artifact is unsigned or its signature is invalid.
• CI generates and publishes a SHA-256 manifest for every release.
• Release artifacts undergo automated malware/security scanning before publication.
• The release page and installation documentation explain how users can verify artifact hashes and signatures.
• Existing .sig files are reviewed and their purpose and verification method are documented.