ci(macos): sign without get-task-allow, and show the notary log on refusal

The first notarized submission came back Invalid: xcodebuild build injects
com.apple.security.get-task-allow into the signature, which archive would
have stripped and which notarization and App Store review both reject.
build_signed.sh now passes CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO and
refuses an app still signed with it, before any upload.

notarytool exits 0 on Invalid, and the step learned the result only when
stapling failed with an unrelated-looking CloudKit error. It now reads the
status, and on anything but Accepted prints Apple's log and names the
submission.

scripts/macos/build_signed.sh

@@ -50,11 +50,15 @@ echo "signing identity: $identity" >&2
 
 # The profile specifier is a Runner-only setting (project.pbxproj reads it from
 # HASH_BAGS_MACOS_PROFILE), so the pods never see a profile they would refuse.
+# `xcodebuild build`, unlike `archive`, injects com.apple.security.get-task-allow
+# into the signature; the notary service rejects any executable carrying it.
+# CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO keeps the entitlements to our own file.
 xcodebuild -workspace macos/Runner.xcworkspace -scheme Runner \
     -configuration Release -derivedDataPath "$derived" \
     CODE_SIGN_IDENTITY="$identity" \
     DEVELOPMENT_TEAM="$team" \
     HASH_BAGS_MACOS_PROFILE="$name" \
+    CODE_SIGN_INJECT_BASE_ENTITLEMENTS=NO \
     OTHER_CODE_SIGN_FLAGS="--keychain $keychain --timestamp" \
     "$@" build >&2
 
@@ -68,6 +72,11 @@ if grep -q '\$(' "$work/entitlements.plist"; then
     grep '\$(' "$work/entitlements.plist" >&2
     exit 1
 fi
+if grep -q 'get-task-allow' "$work/entitlements.plist"; then
+    # Notarization and App Store review both reject it, minutes later and remotely.
+    echo "FATAL: $app is signed with com.apple.security.get-task-allow, a debug-only entitlement" >&2
+    exit 1
+fi
 [ -f "$app/Contents/embedded.provisionprofile" ] || {
     echo "FATAL: $app carries no embedded provisioning profile" >&2; exit 1; }