Close maintainability refactor gaps

Fix bundled backend resource contract

Refactor app and backend coordination for maintainability

Polish release workflow guardrails and local skills

Fix hardened-runtime verification under pipefail

Fix release server tests for lightweight CI env

Prepare 1.2.3 release

Refresh local skills for signed dual-UI release workflow

Enforce macOS 15 MLX Metal release compatibility

Sign release DMGs before notarization

Use primary-signature context for DMG Gatekeeper checks

Skip Gatekeeper app check before notarization

Fix nested entitlements verifier stdin handling

Use XML entitlements when verifying nested runtime

Force embedded entitlements onto nested Python runtime