feat: macOS 公证策略 — 大版本公证，小版本只签名

- workflow_dispatch 新增 mac_notarize 输入（auto/on/off）
- auto 模式：vX.Y.0 签名+公证，vX.Y.Z(Z>0) 只签名不公证
- 打包超时调整为 35 分钟，notarize=false 时传 -c.mac.notarize=false
- 凭证校验步骤仅在需要公证时执行

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -13,6 +13,15 @@ on:
           - windows
           - macos
           - linux
+      mac_notarize:
+        description: "mac notarization mode"
+        required: false
+        default: "auto"
+        type: choice
+        options:
+          - auto
+          - "on"
+          - "off"
   push:
     tags:
       - "v*"
@@ -79,8 +88,37 @@ jobs:
           printf '%s' "$MAC_CERT_P12_BASE64" | tr -d '\r\n' | base64 --decode > /tmp/cert.p12
           openssl pkcs12 -in /tmp/cert.p12 -passin pass:"$MAC_CERT_PASSWORD" -noout
 
+      - name: Resolve mac notarization strategy
+        id: mac_mode
+        shell: bash
+        env:
+          MANUAL_MODE: ${{ github.event_name == 'workflow_dispatch' && inputs.mac_notarize || 'auto' }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          MODE="${MANUAL_MODE:-auto}"
+          NOTARIZE=false
+
+          if [[ "$MODE" == "on" ]]; then
+            NOTARIZE=true
+          elif [[ "$MODE" == "off" ]]; then
+            NOTARIZE=false
+          else
+            # auto: vX.Y.0 公证；vX.Y.Z(Z>0) 只签名
+            if [[ "$REF_NAME" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+              PATCH="${BASH_REMATCH[3]}"
+              if [[ "$PATCH" == "0" ]]; then
+                NOTARIZE=true
+              fi
+            fi
+          fi
+
+          echo "mode=$MODE" >> "$GITHUB_OUTPUT"
+          echo "notarize=$NOTARIZE" >> "$GITHUB_OUTPUT"
+          echo "Resolved mac notarization: $NOTARIZE (mode=$MODE, ref=$REF_NAME)"
+
       - name: Validate notarization credentials
-        if: ${{ env.HAS_CERT == 'true' }}
+        if: ${{ env.HAS_CERT == 'true' && steps.mac_mode.outputs.notarize == 'true' }}
         env:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
@@ -93,19 +131,25 @@ jobs:
             --team-id "$APPLE_TEAM_ID" >/dev/null
 
       - name: Package for macOS (x64 + arm64)
-        timeout-minutes: 25
+        timeout-minutes: 35
         env:
           CSC_LINK: ${{ env.HAS_CERT == 'true' && '/tmp/cert.p12' || '' }}
           CSC_KEY_PASSWORD: ${{ secrets.MAC_CERT_PASSWORD }}
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+          APPLE_ID: ${{ steps.mac_mode.outputs.notarize == 'true' && secrets.APPLE_ID || '' }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ steps.mac_mode.outputs.notarize == 'true' && secrets.APPLE_APP_SPECIFIC_PASSWORD || '' }}
+          APPLE_TEAM_ID: ${{ steps.mac_mode.outputs.notarize == 'true' && secrets.APPLE_TEAM_ID || '' }}
           DEBUG: electron-notarize*
         run: |
           set -euo pipefail
+
+          EXTRA_ARGS=()
+          if [[ "${{ steps.mac_mode.outputs.notarize }}" != "true" ]]; then
+            EXTRA_ARGS=(-c.mac.notarize=false)
+          fi
+
           for i in 1 2 3; do
-            echo "electron-builder attempt $i/3"
-            if npx electron-builder --mac --config electron-builder.yml --publish never; then
+            echo "electron-builder attempt $i/3 (notarize=${{ steps.mac_mode.outputs.notarize }})"
+            if npx electron-builder --mac --config electron-builder.yml "${EXTRA_ARGS[@]}" --publish never; then
               exit 0
             fi
             if [ "$i" -lt 3 ]; then
@@ -159,6 +203,11 @@ jobs:
             exit 1
           fi
 
+      - name: Print mac release mode
+        run: |
+          echo "mac_notarize_mode=${{ steps.mac_mode.outputs.mode }}"
+          echo "mac_notarize=${{ steps.mac_mode.outputs.notarize }}"
+
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with: