fix(macos): declare DWG/DXF UTIs, sandbox the QL appex, add signed-build script (#365)

Finder thumbnails and "Open with" registration fail in the field for
three compounding reasons: the app claims com.autodesk.dwg/.dxf but
never declares them (UTImportedTypeDeclarations was missing, so on
systems with no other declarer Launch Services can't bind the
extensions at all); the QuickLook appex only serves com.autodesk.dwg
while machines with AutoCAD installed resolve .dwg to its exported
com.autodesk.autocad.dwg (BricsCAD etc. likewise win with their own
UTIs); and the ad-hoc --deep signature carries no entitlements, but a
QuickLook thumbnail extension must be sandboxed
(com.apple.security.app-sandbox) before macOS will run it.

Import-declare both UTIs, claim and serve the AutoCAD variants too,
add the appex sandbox entitlements, and add
packaging/build_macos_signed.sh — a local mirror of the CI build-macos
job that signs with a Developer ID (hardened runtime, per-component
entitlements), notarizes and staples. DEVELOPER_ID=- reproduces the
CI ad-hoc build.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/dwg-thumbnailer/macos/Info.plist

@@ -33,6 +33,14 @@
             <key>QLSupportedContentTypes</key>
             <array>
                 <string>com.autodesk.dwg</string>
+                <!-- QuickLook matches these against the UTI the *system*
+                     resolves for a .dwg file, which is whatever the
+                     highest-precedence installed declaration says. With
+                     AutoCAD installed that is its exported UTI below — list
+                     it too or thumbnails never render on those machines
+                     (#365). Other CAD apps' exported UTIs (e.g. BricsCAD's)
+                     can be appended here as they are identified. -->
+                <string>com.autodesk.autocad.dwg</string>
             </array>
             <key>QLThumbnailMinimumDimension</key>
             <integer>0</integer>

crates/dwg-thumbnailer/macos/entitlements.plist

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- Entitlements for the DWG QuickLook Thumbnail Extension (.appex).
+
+     App Extensions MUST be sandboxed: without com.apple.security.app-sandbox
+     the extension registers (shows up in System Settings and pluginkit) but
+     secd/QuickLook refuses to launch it, so Finder simply never renders a
+     thumbnail — with no error anywhere (#365). The system hands the appex a
+     read-only security-scoped handle to the file being thumbnailed, so no
+     other entitlement is needed. -->
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.app-sandbox</key>
+    <true/>
+</dict>
+</plist>