ci(macos): GitHub Actions universal .pkg 构建与发布

- release.yml 重构为 build-windows / build-macos / release 三 job 并行,
  macOS 产 universal(arm64+x86_64) .pkg 并入同一草稿 Release;
  release notes 生成由 PowerShell 改写为 bash(逻辑等价)
- ci.yml 加 changes 门控 + macos-check(仅 wind_macos/**、wind_input/** 改动触发)
- build.sh/app.sh/setting.sh/pkg.sh 支持 WIND_MAC_UNIVERSAL / --universal:
  Go lipo 合并、swift --arch 双架构、wails darwin/universal、hostArchitectures
- app.sh 从 VERSION 文件注入 CFBundleShortVersionString(版本随 tag 贯通)
- pkg.sh 产物改名 -macOS 后缀, 预留 Developer ID 签名 + notarytool 公证接口
- CI 工具链对齐 dev: pnpm 11.3.0 + Node 22 (pnpm 11 需 Node>=22.13;
  pnpm 9 不识别 pnpm-workspace.yaml 的 allowBuilds 键)
- setting.sh 在 wails generate 前建 stub frontend/dist, 修全新检出下
  //go:embed all:frontend/dist 报 no matching files found
- release job 用通配符收集资产, 不依赖精确版本文件名

Author: huanfeng

.github/workflows/ci.yml

@@ -52,3 +52,41 @@ jobs:
       - name: Vet wind_setting
         working-directory: wind_setting
         run: go vet ./...
+
+  # 门控: 仅当 macOS 相关路径改动时才触发昂贵的 macos-14 编译校验 (runner 计费约 10x).
+  # GitHub 不支持 per-job paths, 故用一个 ubuntu 廉价 job 输出是否命中, macos-check 据此 if 短路.
+  changes:
+    name: Detect macOS-related changes
+    runs-on: ubuntu-latest
+    outputs:
+      macos: ${{ steps.filter.outputs.macos }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            macos:
+              - 'wind_macos/**'
+              - 'wind_input/**'
+
+  # 轻量 macOS 编译校验: 只 swift build + go build, 不打包、不跑 Wails 全量.
+  macos-check:
+    name: macOS Build Check
+    needs: changes
+    if: needs.changes.outputs.macos == 'true'
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: wind_input/go.mod
+
+      - name: Build wind-input-app (Swift IME)
+        working-directory: wind_macos
+        run: swift build --product wind-input-app
+
+      - name: Build wind_input (Go service, darwin)
+        working-directory: wind_input
+        run: go build ./...