macos-distribution-workflowlisted

# macOS Distribution Workflow ## Purpose Treat a signed exported artifact as the source of truth for macOS distribution diagnosis. This workflow distinguishes project/account provisioning from artifact trust: inspect the bundle, classify the failure, and use the minimum verifiable repair or release-validation path. ## When To Use - Use for `.app`, `.pkg`, or disk-image distribution artifacts; signing state; entitlements; hardened runtime; nested signatures; Gatekeeper; notarization; stapling; and direct-distribution failures. - Do not use for ordinary Debug builds, account-side certificate/profile creation, or project signing-setting edits without an artifact diagnosis. ## Single-Path Workflow 1. Apply the Apple docs gate through `explore-apple-swift-docs`. Confirm the distribution channel and current signing/notarization requirement before acting. 2. Identify the exact artifact, distribution channel, main executable, nested frameworks/helpers/extensions, signing identity, and observed user-visible failure. 3. Read `references/artifact-inspection-and-classification.md` and inspect bundle structure, signature details, entitlements, nested code, and Gatekeeper assessment before prescribing a fix. 4. Classify the problem: unsigned/ad hoc signing, wrong identity, entitlement mismatch, hardened-runtime issue, nested-code ordering issue, sandbox issue, Gatekeeper assessment, or notarization/stapling readiness. 5. Keep account-side provisioning with `apple-developer-provisioni