feat: add macOS ARM64 desktop release

[hututuQQQ]

Summary

• add a native Apple Silicon desktop build for macOS 13.5+ with DMG and updater ZIP outputs
• make Apple signing credentials all-or-none; support an explicit unsigned preview path and signed Developer ID/notarized builds
• sign the embedded Sigma Runtime Mach-O files in signed builds and emit desktop provenance/signing evidence
• bump the coordinated desktop release to v0.1.6

Validation

• pnpm build:desktop
• full typecheck and lint
• 34 focused desktop build/evidence tests
• 387 desktop package tests
• packaged Electron smoke test
• isolated integrated UI validation with the T3 app test harness

Coordinated Runtime/release pipeline: hututuQQQ/sigma#96