macOS: package as Goblin.app bundle, not a bare binary

The macOS CI job lipo'd the universal binary and zipped it raw, so users got a
naked 'goblin' executable instead of a double-clickable app. Assemble the
universal binary into the existing macos/Goblin.app bundle (Info.plist + icon),
ad-hoc codesign it (required for the arm64 slice to run on Apple Silicon after
lipo strips the per-arch signature), and ditto-zip the bundle. Remove the stale
tracked _CodeSignature that would otherwise make the app read as 'damaged'.

.github/workflows/release.yml

@@ -93,12 +93,26 @@ jobs:
           rustup target add aarch64-apple-darwin x86_64-apple-darwin
           cargo build --release --target aarch64-apple-darwin
           cargo build --release --target x86_64-apple-darwin
-      - name: Universal binary + package
+      - name: Universal binary into Goblin.app bundle
         run: |
+          # Combine both arches into one universal Mach-O and drop it into the
+          # app bundle's executable slot (CFBundleExecutable=goblin).
           lipo -create -output goblin \
             target/aarch64-apple-darwin/release/goblin \
             target/x86_64-apple-darwin/release/goblin
-          zip "goblin-$TAG-macos-universal.zip" goblin
+          cp goblin macos/Goblin.app/Contents/MacOS/goblin
+          chmod +x macos/Goblin.app/Contents/MacOS/goblin
+          # Drop the placeholder that kept the empty dir tracked in git.
+          rm -f macos/Goblin.app/Contents/MacOS/.gitignore
+          # Ad-hoc sign (no Apple cert in CI). REQUIRED on Apple Silicon: lipo
+          # strips the per-arch signatures cargo/ld add, and an unsigned arm64
+          # Mach-O is killed by the OS. Ad-hoc gives a valid (if unidentified)
+          # signature; users still right-click → Open past Gatekeeper.
+          codesign --force --sign - macos/Goblin.app/Contents/MacOS/goblin
+          codesign --force --sign - macos/Goblin.app
+          # ditto is the macOS-correct way to zip an .app (preserves the bundle
+          # layout, symlinks and permissions; plain `zip` mangles bundles).
+          ditto -c -k --keepParent macos/Goblin.app "goblin-$TAG-macos-universal.zip"
           shasum -a 256 "goblin-$TAG-macos-universal.zip" > "goblin-$TAG-macos-universal-sha256sum.txt"
       - uses: softprops/action-gh-release@v2
         with: