Add entitlements for Developer ID signing + notarization

WhisperDictate.entitlements: non-sandboxed hardened-runtime entitlements
(app-sandbox=false; cs.disable-library-validation for the bundled whisper-cli
+ ggml/whisper dylibs). Used to deep-sign the app with the company Developer ID
identity before notarization. Also ignore the stray Contents/CodeResources
signing artifact.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitignore

@@ -3,6 +3,7 @@ macos/build/
 macos/WhisperDictate.app/Contents/MacOS/
 macos/WhisperDictate.app/Contents/Frameworks/
 macos/WhisperDictate.app/Contents/_CodeSignature/
+macos/WhisperDictate.app/Contents/CodeResources
 WhisperDictate
 *.o
 *.dSYM/

macos/WhisperDictate.entitlements

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!-- Not sandboxed: WhisperDictate uses global Accessibility / synthetic
+	     keystrokes and spawns a bundled CLI, which the App Sandbox forbids.
+	     Distributed via Developer ID, not the Mac App Store. -->
+	<key>com.apple.security.app-sandbox</key>
+	<false/>
+	<!-- The app bundles whisper-cli + ggml/whisper dylibs in the app. Disabling
+	     library validation lets the process tree load them without tripping the
+	     hardened runtime's same-Team-ID check. -->
+	<key>com.apple.security.cs.disable-library-validation</key>
+	<true/>
+</dict>
+</plist>