[codex] Stabilize probes and add verifiable DMG releases

[futeng]

What changed

• reduce full-run target concurrency from 6 to 3 and stagger target startup
• use median latency for typical status while retaining P95 tail visibility
• build an ad-hoc signed Universal DMG for Apple Silicon and Intel
• generate and publish a SHA-256 checksum with each release
• verify the final mounted DMG, app signature, Bundle ID, and both architectures before publishing
• generate signed GitHub Artifact Attestation provenance for the final DMG
• run DMG packaging verification in regular CI
• document checksum, provenance verification, and first-launch Gatekeeper steps

Why

Full checks could create their own short proxy/TLS bursts and overstate isolated tail latency. Separately, the release pipeline produced a DMG and checksum but did not prove build provenance or verify the contents of the final mounted image.

Validation

• swift test --package-path NetPulse: 24 tests passed
• local Universal DMG built successfully
• SHA-256 verification passed
• DMG CRC verification passed
• mounted app passed strict code-signature verification
• Bundle ID verified as com.ftpai.futeng.NetPulse
• executable verified with x86_64 and arm64 slices
• signing mode verified as ad-hoc
• release and CI workflow files parsed as valid YAML

Distribution model

The project intentionally remains free of Developer ID requirements. GitHub Release supplies the Universal DMG and checksum, while GitHub Artifact Attestation binds the DMG digest to the public repository, workflow, and source commit. The app remains unnotarized, so macOS first-launch confirmation is still documented and required.