Template Link Reliability & Signed macOS Releases

Improved

• Template install deep links now use the `onedevtool://` scheme because `1devtool://` was ignored by Chrome, Safari, and most browsers; previously published `1devtool://` links still work through a compatibility fallback

• Release pipeline now verifies that every macOS ZIP is Developer ID signed with the expected StoicSoft Team ID and bundle identifier, blocking ad-hoc or mismatched artifacts before they ship