build: manage macOS runner service and optional notarization

.github/workflows/macos-package.yml

@@ -9,6 +9,11 @@ on:
         options: [test, production]
         default: test
         required: true
+      skip_notarization:
+        description: 'Skip notarization/stapling: internal debugging only, not for distribution or updates'
+        type: boolean
+        default: false
+        required: true
       build_version:
         description: 'Version: auto recommended; explicit version must match the checkout product prefix'
         type: string
@@ -30,6 +35,7 @@ jobs:
       run:
         shell: bash
     env:
+      PACKAGE_SKIP_NOTARIZATION: ${{ inputs.skip_notarization }}
       DSH_TELEMETRY_DISABLED: '1'
       DSH_PACKAGING_PRESET: ${{ inputs.preset }}
     steps:
@@ -54,11 +60,17 @@ jobs:
       - name: Check packaging configuration and toolchain
         env:
           PACKAGE_VERSION: ${{ steps.settings.outputs.version }}
-        run: pnpm run package:desktop:mac:arm64 --check --build-version "$PACKAGE_VERSION"
-      - name: Build signed and notarized installers
+        run: |
+          args=()
+          if [[ "$PACKAGE_SKIP_NOTARIZATION" = true ]]; then args+=(--skip-notarization); fi
+          pnpm run package:desktop:mac:arm64 --check --build-version "$PACKAGE_VERSION" "${args[@]}"
+      - name: Build signed installers
         env:
           PACKAGE_VERSION: ${{ steps.settings.outputs.version }}
-        run: pnpm run package:desktop:mac:arm64 --build-version "$PACKAGE_VERSION"
+        run: |
+          args=()
+          if [[ "$PACKAGE_SKIP_NOTARIZATION" = true ]]; then args+=(--skip-notarization); fi
+          pnpm run package:desktop:mac:arm64 --build-version "$PACKAGE_VERSION" "${args[@]}"
       - name: Retain packaging diagnostics
         if: always() && steps.checkout.outcome == 'success'
         uses: actions/[email protected]
@@ -68,14 +80,14 @@ jobs:
           path: apps/desktop/.desktop-build/packaging-runs/
           if-no-files-found: warn
           retention-days: 14
-      - name: Retain verified installers
+      - name: Retain installers for the selected mode
         if: success()
         uses: actions/[email protected]
         with:
-          name: macos-arm64-signed-${{ steps.settings.outputs.version }}-${{ github.run_id }}-${{ github.run_attempt }}
+          name: macos-arm64-${{ steps.settings.outputs.mode }}-${{ steps.settings.outputs.version }}-${{ github.run_id }}-${{ github.run_attempt }}
           include-hidden-files: true
           path: |
-            apps/desktop/.desktop-build/targets/mac-arm64/artifacts/*.dmg
-            apps/desktop/.desktop-build/targets/mac-arm64/artifacts/*.zip
+            apps/desktop/.desktop-build/targets/mac-arm64/${{ steps.settings.outputs.artifacts }}/*.dmg
+            apps/desktop/.desktop-build/targets/mac-arm64/${{ steps.settings.outputs.artifacts }}/*.zip
           if-no-files-found: error
           retention-days: 14