sign Release build with the sttlab-apps identity, add install README

The app bundle was ad-hoc signed (Xcode's automatic default), so trusting
the sttlab-apps cert wouldn't have done anything for Gatekeeper on the
outer .app — only the embedded audiotee binary was actually signed with
it. Switch the Release config to sign with sttlab-apps too, matching what
audiotee already does, so the two documented install paths in README.md
(trust the cert, or bypass Gatekeeper per-download) both actually work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitignore

@@ -10,3 +10,8 @@ DerivedData/
 # compute WER against transcriptor-ai) — large binary media, not source.
 # See CLAUDE.md for what's in here and the results obtained from it.
 /test/
+
+# Distribution zips — built locally and uploaded to Gitea releases directly,
+# not committed (large binary, would bloat the repo; the release is already
+# the canonical place to find them).
+*.app.zip