build(sender): add persistent signing and update identity checks

[Betafer]

Why (draft for build-policy review)

In our local Mini/iMac setup, replacing an ad-hoc-signed Sender during development repeatedly changed its signing identity. This proposal makes persistent signing explicit and provides a check before replacing an installed Sender.

I am leaving this as a draft for your distribution/build-policy review. It is independently rebased on maint-3.5 (fb45b5f); it does not include application, pairing, input, or login-item changes.

Change

• Accept a persistent code-signing certificate by exact fingerprint via environment or a local build configuration file.
• Preserve the upstream unconfigured disposable CI/development build, with a warning. TARGETBRIDGE_REQUIRE_PERSISTENT_SIGNING=1 requires persistent signing; a configured identity also enables strict preflight, never silently falling back after failure. The standalone signing helper requires two explicit settings for ad-hoc signing.
• Build/sign in staging so a failed build does not destroy the previous output.
• Package a standalone executable (ENABLE_DEBUG_DYLIB=NO) rather than Xcode's preview/debug-dylib layout, which contains unsigned nested preview libraries when code signing is disabled during compilation. Interactive Xcode builds are unchanged.
• Verify the complete candidate signature and the installed Sender's literal designated requirement before an update, including all architectures.
• Reject unexpected bundle IDs, ad-hoc baselines/candidates, unavailable identities, and tampered bundles.
• Document private persistent signing versus Developer ID / notarized public distribution.

No certificate or private key is included. The scripts do not create/trust/export certificates, change TCC, or grant permissions. Stable identity is a prerequisite for update continuity, not a guarantee or a bypass of macOS permission decisions.

Validation

• scripts/test_sender_signing_guards.sh <built-app>: seven negative guard checks pass.
• scripts/test_sender_signing.sh <built-app>: persistent-signature continuity passes for distinct signed executables; missing/unavailable identity, implicit ad-hoc signing, ad-hoc baseline/update, wrong bundle IDs, and tampered candidate/baseline are rejected.
• These tests operated on temporary fixtures with an already configured local signing identity; no installed application or permission setting was changed.
• The updated build helper also compiled, staged, and signed the complete Sender successfully; the signature tests were repeated on that output. Missing configured identity is rejected before compilation.

Real first-grant / permission migration and public Developer ID distribution remain separate interactive/distribution validation. This proposes an optional update-safe mode without forcing certificate provisioning into CI or the current release workflow.