fix(ci): re-sign macOS CLI binaries after cross-compilation

[benrfairless]

Issue for this PR

Closes #46313

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

The darwin CLI binaries are cross-compiled on a Linux runner (packages/opencode/script/build.ts via Bun.build({ compile })). Bun injects the JS payload into its pre-signed executable and nothing re-signs it, so the shipped binary fails codesign --verify (x64 still carries Bun's Developer ID, arm64 a stale linker adhoc signature). macOS can never cache validation, which causes ~10s launches under EDR agents and the Xcode MCP SIGKILL (Code Signature Invalid) crashes reported in the issue.

Windows already has a sign-cli-windows job; this adds the macOS analog:

• new sign-cli-macos job downloads the opencode-cli artifact, adhoc re-signs the three darwin binaries (codesign --force --sign -, same approach packages/desktop/scripts/utils.ts already uses for the bundled CLI), verifies with codesign --verify --strict, smoke tests, repacks the zips with the same layout as build.ts, and re-uploads the release assets with --clobber
• the publish job now depends on it and replaces the unsigned darwin dirs/zips with the signed artifact before script/publish.ts runs, so npm platform packages ship signed binaries and the Homebrew sha256 matches the release zips

This works because replacing the invalid embedded signature with a fresh adhoc one makes it match the file contents again, so validation passes and gets cached. Developer ID + notarization (which would also keep FDA grants across updates) can be layered on later using the existing APPLE_CERTIFICATE secrets, but needs JIT entitlements and a notarytool flow, so it's left as a follow-up.

How did you verify your code works?

• actionlint on the workflow: no new findings
• verified the repack step produces zip entry paths identical to what build.ts produces
• the signing command is the exact fix the issue reporter verified locally (codesign -s - -f making --version and codesign --verify pass), and matches what the desktop build already does to the same bun-compiled binary
• full end-to-end requires a release run of publish.yml, which I can't trigger from a fork

Screenshots / recordings

Not a UI change.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Thanks for updating your PR! It now meets our contributing guidelines. 👍