Describe the feature or problem you’d like to solve

Mac OS Installer package support added in #7554 should sign .pkg with an appropriate Developer ID Installer-signing identity.

• MacOS build logic within GoReleaser including signing hook
• existing sign_macos logic within script/sign
• existing installer packaging logic within script/pkgmacos

Additional context

The existing GitHub CLI deployment workflow only has access to Developer ID Application certificate, which cannot be reused in for Installer packages.