sign Release build with the sttlab-apps identity, add install README

The app bundle was ad-hoc signed (Xcode's automatic default), so trusting
the sttlab-apps cert wouldn't have done anything for Gatekeeper on the
outer .app — only the embedded audiotee binary was actually signed with
it. Switch the Release config to sign with sttlab-apps too, matching what
audiotee already does, so the two documented install paths in README.md
(trust the cert, or bypass Gatekeeper per-download) both actually work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitignore

@@ -10,3 +10,8 @@ DerivedData/
 # compute WER against transcriptor-ai) — large binary media, not source.
 # See CLAUDE.md for what's in here and the results obtained from it.
 /test/
+
+# Distribution zips — built locally and uploaded to Gitea releases directly,
+# not committed (large binary, would bloat the repo; the release is already
+# the canonical place to find them).
+*.app.zip

README.md

@@ -0,0 +1,62 @@
+# transcriptor
+
+Native macOS app for fully local, no-cloud meeting transcription. Download, unzip, run —
+the only runtime download is the ASR model itself (see `CLAUDE.md` for how the app is built).
+
+## Installing from a downloaded release
+
+Grab `transcriptor-vX.Y.Z.app.zip` from the
+[releases page](https://gitea.sttlab.eu/stt/transcriptor/releases), unzip it, and drag
+`transcriptor.app` to `/Applications`.
+
+The app is signed with a self-signed identity (`sttlab-apps`), not an Apple Developer ID —
+there's no paid Apple account behind this project. macOS's Gatekeeper doesn't trust that
+signature by default, so on first launch of a version downloaded from a browser (which
+macOS marks with a quarantine flag) you'll likely see it refuse to open, or ask to move it to
+the bin. Pick **one** of the two options below to get past that — you don't need both.
+
+### Option 1 — Trust the `sttlab-apps` certificate
+
+This tells your Mac to trust anything signed by this specific certificate going forward, so
+you won't need to repeat this for future versions of the app (as long as it keeps being signed
+with the same identity).
+
+1. Get the certificate: `sttlab-apps.cer` (ask for it, or export it yourself if you have
+   access to the machine it was created on: `security find-certificate -c "sttlab-apps" -p
+   > sttlab-apps.cer`).
+2. Import it into your login keychain:
+   ```bash
+   security import sttlab-apps.cer -k ~/Library/Keychains/login.keychain-db
+   ```
+3. Trust it, but **only** for code signing (not as a general root CA):
+   ```bash
+   security add-trusted-cert -r trustRoot -p codeSign \
+     -k ~/Library/Keychains/login.keychain-db sttlab-apps.cer
+   ```
+   macOS will prompt for your login password — that's it asking permission to change
+   keychain trust settings, not this command asking for a password directly.
+4. Open `transcriptor.app` normally (double-click, or `open /Applications/transcriptor.app`).
+
+### Option 2 — Bypass Gatekeeper for this app only
+
+No trust changes, no certificate needed — just tells macOS to stop flagging this specific
+app. You'll need to repeat this for each new version you download (the quarantine flag is
+set per downloaded file).
+
+Either:
+
+- Right-click `transcriptor.app` in Finder → **Open** → **Open** again in the confirmation
+  dialog. (Regular double-click won't offer this the first time; right-click → Open does.)
+
+Or, from a terminal:
+
+```bash
+xattr -dr com.apple.quarantine /Applications/transcriptor.app
+```
+
+(`-r` because it's a bundle — the quarantine flag can be set on files inside it too, not just
+the top-level `.app`.)
+
+Both achieve the same result: the app opens. Option 1 is the better choice if you expect to
+download future versions and don't want to repeat the bypass each time; Option 2 is faster
+for a one-off.

transcriptor.xcodeproj/project.pbxproj

@@ -459,7 +459,8 @@
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				ASSETCATALOG_COMPILER_GLOBAL_ACCENT_COLOR_NAME = AccentColor;
-				CODE_SIGN_STYLE = Automatic;
+				CODE_SIGN_STYLE = Manual;
+				CODE_SIGN_IDENTITY = "sttlab-apps";
 				CURRENT_PROJECT_VERSION = 1;
 				ENABLE_APP_SANDBOX = NO;
 				ENABLE_USER_SCRIPT_SANDBOXING = NO;