Configure Apple credentials and verify MacDiff notarized tag releases #8

The tag-release automation in #9 needs Apple credentials in stuartd/macdiff before its first notarized release. The certificate and Apple account already used for ClipDiff can be reused; repository secrets do not transfer automatically between repositories.

• In Keychain Access on your Mac, export the Developer ID Application certificate with its private key from My Certificates as a password-protected .p12. An Apple Development certificate will not work.
• Add the following five MacDiff repository Actions secrets, or grant this repository access to equivalent organization secrets:

You can upload the certificate directly without copying or displaying it, then enter the other values at the CLI prompts:

base64 -i /path/to/DeveloperID.p12 | gh secret set BUILD_CERTIFICATE_BASE64 --repo stuartd/macdiff
gh secret set P12_PASSWORD --repo stuartd/macdiff
gh secret set APPLE_ID --repo stuartd/macdiff
gh secret set APPLE_TEAM_ID --repo stuartd/macdiff
gh secret set APPLE_APP_SPECIFIC_PASSWORD --repo stuartd/macdiff

Do not put secret values, certificate files, or private keys in this issue, a PR, or the repository. A local notarytool Keychain profile is not available on GitHub runners; the workflow creates its own temporary profile. GitHub's built-in token publishes releases, so no personal access token is needed for the workflow.

• Merge the tag-release automation PR. For an optional build-only check, run Actions → Build Release → Run workflow on main; this produces an ad hoc signed universal artifact without notarization or publication.
• Check CFBundleShortVersionString in Resources/Info.plist and choose a new matching release tag. The current value is 1.0; the tag does not rewrite the app's version. From the merged commit, for example:

git switch main
git pull --ff-only
git tag v1.0
git push origin v1.0

Use a new tag if v1.0 already exists. A tag such as v1.0-rc.1 creates a GitHub prerelease.

• Confirm Build Release completes and the GitHub Release contains MacDiff-<version>-<commit>.zip and its .zip.sha256 file. Download the ZIP, verify its checksum, extract it, and launch the app on a Mac. The workflow verifies the signature, stapled ticket, and Gatekeeper acceptance of the extracted archive before publishing.

Missing credentials, Apple's rejection, or verification failure stops publication. Inspect the MacDiff-notarization workflow artifact for submission results and available diagnostic logs. If Apple's processing times out, inspect the recorded submission ID before rerunning. Rerunning a successful tag workflow updates that release's assets.

The live Developer ID signing/notarization run remains unverified until these credentials are supplied. macOS CI passes the credential tests, full app test suite, and signed development-bundle build. Linux also validates 62 portable tests, credential-setup control flow, workflow syntax, and shell syntax.