build(release): build, sign and package with stock Apple tools

[datlechin]

Why

The release scripts carried checks and options that Apple's tools already do or default, an unpinned Homebrew create-dmg in the signing job, and the same build setup in four places.

Change

• build.sh, notarize.sh: drop check_signature (the notary service rejects the same defects), the dead Contents/Helpers glob, stapler validate (staple validates) and a no-op index-store flag; always print the notary log, as Apple asks (build-1 to 4, build-10).
• package.sh: hdiutil create -srcfolder ... -format ULFO with an /Applications link replaces create-dmg; VERSION and BUILD come from the environment like build.sh (build-7, build-8).
• Release Build builds with VERSION=0.0.0-dev BUILD=9999999 and loses its concurrency group; .github/actions/prepare-build holds the shared setup for macOS Tests, Release Build and both tag jobs; the release detector watches only the release scripts the build runs (build-14, pipeline-5, 8, 9).
• ExportOptions.plist, apple-signing, cktool, Base.xcconfig: drop restated defaults, install the profile as GitHub documents, read the CloudKit token from the environment (build-5, 11, 13, pipeline-7).

Verified

test_detect_changed_paths.py, actionlint, shellcheck. Release Build dispatched on this branch (run 39117792525) built and packaged the app and 26 plugins at build 9999999; a local package.sh app --unsigned wrote a ULFO APFS image holding the app and the link.

Not in this PR

The DMG opens in Finder's default view, without create-dmg's icon layout.