Add cs.allow-jit entitlement for whisper.cpp Metal backend

The bundled whisper-cli / ggml dylibs JIT-compile Metal shaders at
runtime; under the hardened runtime that needs com.apple.security.cs.allow-jit
or the process gets killed. Completes the entitlement set for the
notarized Developer ID build (alongside device.audio-input).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

macos/WhisperDictate.entitlements

@@ -19,5 +19,10 @@
 	     on any Developer ID / notarized build. -->
 	<key>com.apple.security.device.audio-input</key>
 	<true/>
+	<!-- whisper.cpp's Metal/ggml backend generates code at runtime; the
+	     hardened runtime needs allow-jit so the bundled whisper-cli/dylibs
+	     don't get killed for JIT. -->
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
 </dict>
 </plist>