fix(ci/release): sign the macOS archive with Developer ID, not auto dev signing

The cert import now yields a valid 'Developer ID Application' identity, but
the macOS `xcodebuild archive` step still inherited the project's automatic
'Apple Development' signing via -allowProvisioningUpdates. That made Xcode try
to mint an Apple Development cert (install fails in the CI keychain,
DVTSecErrorDomain -61 'Write permissions error') and locate a 'Mac App
Development' provisioning profile for io.unom.punktfunk (none exists) —
** ARCHIVE FAILED ** before signing even happened.

A Developer ID DMG needs neither: pin CODE_SIGN_STYLE=Manual + the Developer ID
identity + no profile, mirroring what the export step already does. The app is
non-sandboxed and its only entitlement (keychain-access-groups, team-prefixed)
is authorized by the Developer ID team, so no provisioning profile is required.
ENABLE_HARDENED_RUNTIME=YES is already set, so notarization stays happy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -122,15 +122,24 @@ jobs:
 
       - name: Archive macOS
         run: |
+          # Manual Developer ID signing — same reasoning as the export step below. With
+          # -allowProvisioningUpdates the archive runs AUTOMATIC signing, which tries to mint
+          # an Apple Development cert + a "Mac App Development" profile for io.unom.punktfunk:
+          # installing that cert into the CI keychain fails (DVTSecErrorDomain -61 "Write
+          # permissions error") and no such profile exists — a Developer ID DMG needs
+          # neither. Pin the Developer ID identity and no profile: the app is non-sandboxed
+          # and its lone entitlement (keychain-access-groups, team-prefixed) is authorized by
+          # the Developer ID team itself, so no provisioning profile is required. The ASC key
+          # is still staged above for notarytool + the iOS App Store archive.
           DEVELOPER_DIR="$XCODE_DEV_DIR" xcodebuild archive \
             -project "$PROJECT" -scheme Punktfunk \
             -destination 'generic/platform=macOS' \
             -archivePath "$RUNNER_TEMP/Punktfunk-macos.xcarchive" \
             MARKETING_VERSION="$VERSION" CURRENT_PROJECT_VERSION="$BUILD_NUM" \
-            -allowProvisioningUpdates \
+            CODE_SIGN_STYLE=Manual \
-            -authenticationKeyPath "$RUNNER_TEMP/asc.p8" \
+            CODE_SIGN_IDENTITY="Developer ID Application" \
-            -authenticationKeyID "${{ secrets.ASC_API_KEY_ID }}" \
+            DEVELOPMENT_TEAM="$TEAM_ID" \
-            -authenticationKeyIssuerID "${{ secrets.ASC_API_ISSUER_ID }}"
+            PROVISIONING_PROFILE_SPECIFIER=""
 
       - name: Export macOS (Developer ID)
         run: |