Enable hardened runtime for notarization (CODESIGN_OPTIONS=runtime)

Apple rejects notarization submissions without hardened runtime enabled.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: byshing

.github/workflows/release.yml

@@ -115,6 +115,7 @@ jobs:
       CODESIGN_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
       CODESIGN_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
       CODESIGN_IDENTITY: ${{ secrets.APPLE_CODESIGN_IDENTITY }}
+      CODESIGN_OPTIONS: runtime
       APPLE_NOTARIZE_ID: ${{ secrets.APPLE_NOTARIZE_ID }}
       APPLE_NOTARIZE_PASSWORD: ${{ secrets.APPLE_NOTARIZE_PASSWORD }}
       APPLE_NOTARIZE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}