fix(ci): build darwin binaries on macOS runners to restore code signing

v3.16.0 binaries had 'adhoc,linker-signed' signatures because newer
Bun versions no longer emit linker-signed signatures when cross-compiling
darwin targets from Linux. Current releases have 'code object is not
signed at all', causing macOS Gatekeeper to reject them immediately.

Verified empirically:
- v3.16.0 darwin-arm64: Signature=adhoc, flags=0x20002(adhoc,linker-signed)
- v3.17.0 darwin-arm64: 'code object is not signed at all'
- Local bun build on macos: produces linker-signed signature (matches v3.16.0)

Changes:
- Route darwin-* platforms to macos-latest runner (native compile)
- Add explicit ad-hoc codesign step as belt-and-suspenders safety net

.github/workflows/publish-platform.yml

@@ -35,7 +35,7 @@ jobs:
   # - Uploads compressed artifacts for the publish job
   # =============================================================================
   build:
-    runs-on: ${{ startsWith(matrix.platform, 'windows-') && 'windows-latest' || 'ubuntu-latest' }}
+    runs-on: ${{ startsWith(matrix.platform, 'windows-') && 'windows-latest' || startsWith(matrix.platform, 'darwin-') && 'macos-latest' || 'ubuntu-latest' }}
     defaults:
       run:
         shell: bash
@@ -213,6 +213,14 @@ jobs:
             echo "Built binary:"
             ls -lh "$OUTPUT"
 
+      - name: Ad-hoc codesign darwin binary
+        if: steps.check.outputs.skip != 'true' && startsWith(matrix.platform, 'darwin-')
+        run: |
+          BINARY="packages/${{ matrix.platform }}/bin/oh-my-opencode"
+          codesign --force --sign - --preserve-metadata=entitlements,requirements,flags,runtime "$BINARY"
+          echo "Verifying signature:"
+          codesign -dvvv "$BINARY" 2>&1
+
       - name: Compress binary
         if: steps.check.outputs.skip != 'true'
         run: |