feat: macOS Developer ID 签名 + notarization + 原生热更新

签名 & 公证：
- build/entitlements.mac.plist, build/entitlements.mac.inherit.plist — Electron hardened runtime 所需权限（JIT、unsigned memory、disable library validation）
- electron-builder.yml — 启用 hardenedRuntime、entitlements、notarize: true
- scripts/after-sign.js — 环境变量 + codesign -d 双重检测，有 Developer ID 时跳过 ad-hoc；无证书时 fallback ad-hoc
- .github/workflows/build.yml — 映射签名 secrets（MAC_CERT_P12_BASE64 等），验证步骤断言 Developer ID Authority + TeamIdentifier，遍历双架构 .app

原生热更新：
- electron/updater.ts — 从 no-op 重写为完整 electron-updater 实现（autoDownload:false, IPC handlers, 启动 10s 延迟检查）
- electron/preload.ts — 恢复 updater IPC bridge
- src/components/layout/AppShell.tsx — 运行时检测 native updater，useEffect 监听 updater:status 事件，native 优先 + browser fallback

其他：
- README_CN.md — 更新自动更新功能描述
- package.json — 版本号升至 0.23.0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -70,9 +70,57 @@ jobs:
 
       - name: Package for macOS (x64 + arm64)
         env:
-          CSC_IDENTITY_AUTO_DISCOVERY: "false"
+          CSC_LINK: ${{ secrets.MAC_CERT_P12_BASE64 }}
+          CSC_KEY_PASSWORD: ${{ secrets.MAC_CERT_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: npx electron-builder --mac --config electron-builder.yml --publish never
 
+      - name: Verify code signature
+        run: |
+          # Verify every .app bundle produced (arm64 + x64)
+          APPS=$(find release -name "CodePilot.app" -maxdepth 3)
+          if [ -z "$APPS" ]; then
+            echo "::warning::No CodePilot.app found, skipping signature verification"
+            exit 0
+          fi
+
+          FAILED=0
+          while IFS= read -r APP_PATH; do
+            echo "========== Verifying: $APP_PATH =========="
+
+            # Display signature details
+            codesign -dv --verbose=4 "$APP_PATH" 2>&1 | tee /tmp/codesign-info.txt || true
+
+            # Assert Developer ID authority
+            if ! grep -q 'Authority=Developer ID Application' /tmp/codesign-info.txt; then
+              echo "::error::$APP_PATH is NOT signed with Developer ID Application"
+              FAILED=1
+              continue
+            fi
+
+            # Assert correct Team Identifier
+            if ! grep -q 'TeamIdentifier=K9X599X9Q2' /tmp/codesign-info.txt; then
+              echo "::error::$APP_PATH has unexpected TeamIdentifier"
+              FAILED=1
+              continue
+            fi
+
+            # Strict verification (must pass)
+            codesign --verify --deep --strict --verbose=4 "$APP_PATH"
+
+            # Gatekeeper assessment (best-effort, does not fail the build)
+            spctl -a -vvv --type execute "$APP_PATH" || echo "::warning::spctl assessment did not pass for $APP_PATH (may be expected in CI)"
+
+            echo "✓ $APP_PATH passed all checks"
+          done <<< "$APPS"
+
+          if [ "$FAILED" -ne 0 ]; then
+            echo "::error::One or more .app bundles failed signature verification"
+            exit 1
+          fi
+
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with: