feat: macOS 双架构分离构建 — x64 只签名，arm64 签名+条件公证

CI:
- 拆分为 x64 和 arm64 两个独立构建步骤
- x64: 签名但不公证（-c.mac.notarize=false），timeout 15min
- arm64: 签名 + 按版本号条件公证（vX.Y.0 公证，vX.Y.Z 只签名），timeout 35min
- 先跑 x64，stash 产物后跑 arm64，确保 latest-mac.yml 来自 arm64

Electron:
- electron/main.ts: darwin+x64 跳过 initAutoUpdater
- electron/preload.ts: darwin+x64 不暴露 updater bridge
- 前端 AppShell 已有运行时检测（!!window.electronAPI?.updater），
  x64 自动 fallback 到 browser 模式更新检查

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

electron/main.ts

@@ -938,8 +938,10 @@ app.whenReady().then(async () => {
       autoStartReq.end();
     }
 
-    // Initialize auto-updater in packaged mode only
-    if (!isDev && mainWindow) {
+    // Initialize auto-updater in packaged mode only.
+    // Disabled on macOS x64 (Intel) — those users get browser-mode update check.
+    const skipNativeUpdater = process.platform === 'darwin' && process.arch === 'x64';
+    if (!isDev && mainWindow && !skipNativeUpdater) {
       initAutoUpdater(mainWindow);
     }
   } catch (err) {

electron/preload.ts

@@ -28,14 +28,18 @@ contextBridge.exposeInMainWorld('electronAPI', {
   bridge: {
     isActive: () => ipcRenderer.invoke('bridge:is-active'),
   },
-  updater: {
-    checkForUpdates: () => ipcRenderer.invoke('updater:check'),
-    downloadUpdate: () => ipcRenderer.invoke('updater:download'),
-    quitAndInstall: () => ipcRenderer.invoke('updater:quit-and-install'),
-    onStatus: (callback: (data: unknown) => void) => {
-      const listener = (_event: unknown, data: unknown) => callback(data);
-      ipcRenderer.on('updater:status', listener);
-      return () => { ipcRenderer.removeListener('updater:status', listener); };
+  // Native updater: disabled on macOS x64 (Intel) — those users get browser-mode
+  // update check (download link to GitHub Releases) instead.
+  ...(process.platform === 'darwin' && process.arch === 'x64' ? {} : {
+    updater: {
+      checkForUpdates: () => ipcRenderer.invoke('updater:check'),
+      downloadUpdate: () => ipcRenderer.invoke('updater:download'),
+      quitAndInstall: () => ipcRenderer.invoke('updater:quit-and-install'),
+      onStatus: (callback: (data: unknown) => void) => {
+        const listener = (_event: unknown, data: unknown) => callback(data);
+        ipcRenderer.on('updater:status', listener);
+        return () => { ipcRenderer.removeListener('updater:status', listener); };
+      },
     },
-  },
+  }),
 });