ci(macos): resume notarization polling after network loss

[wgqqqqq]

Summary

The 1.0.6 Intel app compiled, was notarized by Apple, and passed Gatekeeper. The DMG then uploaded successfully, but notarytool submit --wait lost its polling connection (NSURLErrorDomain -1009) and failed the entire job after almost four hours. No verified bundle was uploaded.

Separate submission from waiting. Record the submission ID and DMG SHA256, then retry only polling for the observed -1005 / -1009 network errors. A retry reuses the same submission and requires an explicit matching Accepted response. Invalid results, other failures, changed payloads, signature errors, and Gatekeeper rejection still fail. Keep the receipt bound to the stapled DMG's resulting bytes.

Retain a seven-day unverified recovery tar archive when Apple verification fails. It preserves executable modes, symlinks, and the submission receipt, and cannot match the normal bundle publication pattern or satisfy the complete release gate. Document this behavior in the existing release guide.

Verification

• pnpm run check:github-config: 51 passed, 1 existing pwsh skip.
• Fixtures cover lost/offline polling, retry exhaustion, receipt reuse without another submission, changed payload rejection, missing/mismatched IDs, Apple Invalid status, unrelated errors, and retained tar modes/symlinks.
• node --test scripts/ci/verify-macos-microphone.test.mjs: 4 passed using real ad-hoc signed fixtures.
• bash -n scripts/ci/verify-macos-signing.sh and git diff --check passed.
• Confirmed submit --no-wait --output-format json and wait <submission-id> --output-format json with installed xcrun notarytool ... --help; Apple workflow documentation.

AI-assisted; focused shell/workflow tests were executed locally. The real Intel rebuild will exercise the Apple service path. No signing or notarization check is bypassed; no product, native mobile, persisted user data, or remote protocol changes. The immutable v1.0.6 source tag remains unchanged.