fix(ci): ad-hoc sign darwin binaries with plain codesign

Bun on github macos-latest runners does not emit linker-signed
signatures by default. Sign explicitly with 'codesign --sign -'
without preserve-metadata since the binary has no prior signature.