feat(macos): add native workbench and dmg release ci

[StressTestor]

what changed

• added the SwiftUI macOS PromptPressure workbench with managed FastAPI sidecar, Keychain-backed provider setup, custom themes/providers, app job lifecycle state, in-app reports, diagnostics, plugins, Ollama, and output viewing
• added app-facing sidecar job endpoints, cancellation, custom provider discovery, metadata/output/theme/provider discovery, and reconciliation so the app does not stay running after terminal job state
• added script/build_and_run.sh and script/package_dmg.sh for local app staging and DMG packaging
• added .github/workflows/macos-dmg-release.yml to build a DMG on v* tags or manual workflow dispatch, attach the DMG/checksum to a GitHub Release, and optionally sign/notarize when Apple secrets are configured
• documented the native app, release workflow, signing secrets, and the current dev-sidecar packaging boundary

release workflow

Push a tag like v3.3.0 or run the workflow manually with a tag. Tags with a suffix, like v3.3.0-macos.1, are marked as prereleases. The workflow uploads PromptPressure-<tag>.dmg plus a SHA-256 checksum to the matching GitHub Release.

Signing/notarization is automatic when these secrets exist: APPLE_DEVELOPER_ID_APPLICATION_P12, APPLE_CERTIFICATE_PASSWORD, APPLE_KEYCHAIN_PASSWORD, DEVELOPER_ID_APPLICATION, APPLE_ID, APPLE_TEAM_ID, APPLE_APP_SPECIFIC_PASSWORD, and optional NOTARYTOOL_PROFILE.

validation

• python3 YAML load for .github/workflows/*.yml
• bash -n script/build_and_run.sh script/package_dmg.sh
• swift build && swift run PromptPressureChecks
• uv run --extra dev python -m pytest -q (302 passed, 1 warning)
• APP_VERSION=0.1.0 APP_BUILD=1 ./script/package_dmg.sh
• hdiutil verify dist/PromptPressure.dmg

note

The CI DMG uses the current dev-sidecar package path. It is good for internal release testing; the fully self-contained Python runtime bundle remains the production distribution follow-up.