[stuartd]

MacDiff already has a local notarization script, but pushing a version tag does not build or publish a release. Add a GitHub Actions workflow based on ClipDiff's release flow: v* tags run the existing tests and universal build, import Developer ID credentials into a temporary Keychain, notarize and verify the app, and publish the verified ZIP and SHA-256 checksum with generated release notes.

The publishing job alone receives contents: write. Tagged builds require all five Apple secrets and cannot fall back to ad hoc signing; manual branch builds produce an ad hoc signed artifact without publishing. The release script now supports an explicit signing Keychain and retains Apple's diagnostic log for failed or timed-out submissions. The workflow removes signing credentials even on failure.

The README documents the secrets and release commands. Remaining certificate/secret entry and the first live notarization run are tracked in #8.

Validation:

• Seven synthetic credential-setup tests pass, including missing secrets, development/ambiguous identities, failed import, invalid notarization credentials, and malformed certificate encoding. These tests also run in macOS CI.
• Both workflows pass actionlint 1.7.7; shell syntax and git diff --check pass.
• All 62 portable MacDiff tests pass on Linux.
• macOS CI passes the credential tests, full application test suite, and signed development-bundle build.
• Developer ID signing, Apple notarization, and GitHub publication require the configured Actions secrets and remain unverified until the first release run.