ci: fail release early when signing secrets are missing

[fly1d]

Summary

• add an early release preflight that checks all six Apple signing secrets are present without printing values
• make the macOS build depend on the preflight so missing credentials fail before reserving a macOS runner
• document the behavior in the release guide

Verification

• git diff --check
• local shell checks for empty and complete secret sets
• required CI, browser smoke, desktop, CodeQL, and analyze checks

This does not publish artifacts or change signing behavior.

[fly1d]

Maintainer review: release preflight is correct and scoped. It checks all six Apple signing secrets before reserving a macOS runner, reports only missing names, and the required CI, browser smoke, desktop, CodeQL, and analysis checks are passing. No blocking findings.