feat(build): add opt-in Developer ID signed build script

Alternative to scripts/build-app.sh for contributors with an Apple Developer ID certificate who want a properly signed (and optionally notarized) local build instead of ad-hoc signing + "Open Anyway". Identity/notarization profile are passed via environment variables (CODESIGN_IDENTITY, NOTARY_PROFILE); credentials are expected in the Keychain via 'notarytool store-credentials', never in a file. Does not touch scripts/build-app.sh, so the default ad-hoc-signed flow other contributors rely on is unchanged.