fix: send unsigned binaries to codesign service for proper signing

The codesign service needs to handle the full process (sign, zip, notarize, staple)
on macOS to preserve code signatures correctly. Linux zip corrupts signatures.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: Aleksandr Slapoguzov

.github/workflows/release.yml

@@ -56,40 +56,26 @@ jobs:
         run: |
           ./codesign-client-linux-amd64 -extensions "jsign_replace=true" dist/bin/codex-acp-x64-windows.exe
 
-      - name: Sign macOS binaries
-        env:
-          SERVICE_ACCOUNT_NAME: ${{ vars.SERVICE_ACCOUNT_NAME }}
-          SERVICE_ACCOUNT_TOKEN: ${{ secrets.SERVICE_ACCOUNT_TOKEN }}
-        run: |
-          ./codesign-client-linux-amd64 \
-            -denoted-content-type="application/x-mac-app-bin" \
-            -extensions "mac_codesign_force=true,mac_codesign_options=runtime" \
-            dist/bin/codex-acp-x64-darwin
-          ./codesign-client-linux-amd64 \
-            -denoted-content-type="application/x-mac-app-bin" \
-            -extensions "mac_codesign_force=true,mac_codesign_options=runtime" \
-            dist/bin/codex-acp-arm64-darwin
-
-      - name: Package macOS binaries for notarization
+      - name: Package macOS binaries for signing
         run: |
           zip -j dist/bin/codex-acp-x64-darwin.zip dist/bin/codex-acp-x64-darwin
           zip -j dist/bin/codex-acp-arm64-darwin.zip dist/bin/codex-acp-arm64-darwin
 
-      - name: Notarize and staple macOS binaries
+      - name: Sign, notarize and staple macOS binaries
         env:
           SERVICE_ACCOUNT_NAME: ${{ vars.SERVICE_ACCOUNT_NAME }}
           SERVICE_ACCOUNT_TOKEN: ${{ secrets.SERVICE_ACCOUNT_TOKEN }}
         run: |
           ./codesign-client-linux-amd64 \
             -denoted-content-type="application/x-mac-app-zip" \
-            -extensions "mac_notarize=true,mac_staple=true" \
+            -extensions "mac_codesign_force=true,mac_codesign_options=runtime,mac_notarize=true,mac_staple=true" \
             dist/bin/codex-acp-x64-darwin.zip
           ./codesign-client-linux-amd64 \
             -denoted-content-type="application/x-mac-app-zip" \
-            -extensions "mac_notarize=true,mac_staple=true" \
+            -extensions "mac_codesign_force=true,mac_codesign_options=runtime,mac_notarize=true,mac_staple=true" \
             dist/bin/codex-acp-arm64-darwin.zip
 
-      - name: Extract notarized macOS binaries
+      - name: Repackage macOS binaries
         run: |
           unzip -o dist/bin/codex-acp-x64-darwin.zip -d dist/bin/
           unzip -o dist/bin/codex-acp-arm64-darwin.zip -d dist/bin/