Make macOS notarization opt-in for universal macOS releases

[Copilot]

The build (macos-latest, --target universal-apple-darwin) job was failing after a successful build because the release workflow always attempted Apple notarization, and Apple rejected the request with 403 due to missing/expired account agreements. This change separates build/signing from notarization so CI can still produce the universal macOS artifact when notarization is temporarily unavailable.

• Workflow behavior

  • Split the Tauri release step into:
    • a default path that builds/uploads artifacts without notarization credentials
    • a macOS-only path that includes notarization credentials only when explicitly enabled

• macOS release handling

  • Keep shared release-signing/updater environment at the job level
  • Restrict APPLE_ID, APPLE_PASSWORD, and APPLE_TEAM_ID to the notarization-only step
  • Gate notarization behind the repository variable ENABLE_MACOS_NOTARIZATION == 'true'

• Effect

  • macOS universal builds no longer fail solely because Apple notarization is blocked by external account state
  • Other platform release paths remain unchanged

- name: Build and upload
  if: matrix.platform != 'macos-latest' || vars.ENABLE_MACOS_NOTARIZATION != 'true'
  uses: tauri-apps/tauri-action@v0

- name: Build and upload with notarization
  if: matrix.platform == 'macos-latest' && vars.ENABLE_MACOS_NOTARIZATION == 'true'
  uses: tauri-apps/tauri-action@v0
  env:
    APPLE_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_APPLE_ID }}
    APPLE_PASSWORD: ${{ secrets.PROD_MACOS_NOTARIZATION_PWD }}
    APPLE_TEAM_ID: ${{ secrets.PROD_MACOS_NOTARIZATION_TEAM_ID }}