hack/build-cli-binaries.sh now code-signs and notarizes the two darwin-* binaries with rcodesign (no Xcode/macOS runner needed) when APPLE_CERT_P12_BASE64, APPLE_CERT_PASSWORD and APPLE_API_KEY_JSON_BASE64 are all set as Tangled secrets — refusing a partial set outright, and otherwise building exactly as before. A signed binary can't have a notarization ticket stapled to it (only bundles/dmg/pkg support that), so the signed original ships and a throwaway zip goes to Apple's notary service; Gatekeeper's own online check covers the rest on first launch. Whether a given release's binary actually got signed is threaded through per target — a .signed marker file, into publish-release-images.sh's release manifest, into bake-site-downloads.sh's cli.json, into CliEntry.signed — so the downloads page's quarantine-clearing paragraph renders only when a listed macOS build is actually unsigned. It turns itself off the moment a signed release ships, with no follow-up copy edit needed. publish-sbc-images.yml documents the three secrets (what each is and exactly where to get it) and adds rcodesign + zip to CI's dependencies. The Apple Developer credentials themselves haven't been supplied yet, so this ships inert until they're added to Tangled's secrets store.