ci: recover notarized Mac bundles without rebuilding

[wgqqqqq]

The Intel 1.0.6 build was notarized successfully, but Tauri returned success after leaving the app without its stapled ticket. The strict Apple verifier correctly rejected it. Repeating the whole build would discard three hours of successful compilation.

Add a verification recovery mode to Desktop Package. It restores only a trusted producer's unexpired checkpoint after successful compilation and failed Apple verification, checks the app version and architecture, and runs no product build. For the precise missing-ticket state, it verifies the original updater signature and Developer ID, staples and validates the accepted app, then rebuilds and signs both distribution containers. Valid existing tickets retain their packages and matching notary receipt. Other failures remain failures. The normal Apple/Gatekeeper verifier and complete-platform finalization gate stay in place; only successful verification produces a publishable bundle.

Validation:

• pnpm run check:github-config: 53 passed, one existing PowerShell skip. Covers recovery mode restrictions, trusted source and producer checks, failed/expired/duplicate inputs, ticket error handling, receipt preservation, both repacked containers, and updater signature renewal.
• bash -n scripts/ci/repair-macos-stapling.sh and git diff --check passed.
• Downloaded the real retained Intel bundle: strict app codesign and the original updater signature verify. The app lacks Contents/CodeResources while the successfully stapled ARM64 app contains it.
• Exercised the actual Intel DMG through read/write conversion, app replacement, recompression and remount: strict app signature, metadata and installer layout were preserved. No signing secrets were loaded locally.

No product/runtime changes or remote-scenario claims. Product source remains the immutable v1.0.6 tag.