Add opt-in provisioned macOS CLI release candidates (#44307)

## What changed

- Add a tag-release workflow gated by `CODEX_PROVISIONED_MACOS_CANDIDATE` for Apple Silicon and Intel macOS candidate artifacts.
- Package the CLI in `CodexCLI.app` with an embedded provisioning profile and a relocatable `bin/codex` launcher. Validate independently supplied profile, certificate, and team expectations before signing.
- Sign and notarize candidates, then verify signatures, entitlements, architecture, stapling, and Gatekeeper acceptance on macOS. Retain verified artifacts after package smoke tests pass.
- Filter code-mode smoke-test requests to `/v1/responses` so analytics requests are excluded from response parsing.

## Testing

Add tests for profile validation, launcher relocation and symlink handling, standard and provisioned signing flows, and rejection of signing, notarization, identity, and entitlement failures. The candidate workflow runs package smoke tests, including sandboxed code mode.

GitOrigin-RevId: f214f6a23dd10df62cd72a2c63c20cb0864fbc9c

scripts/codex_package/smoke_tests/test_codex_package.py

@@ -121,9 +121,11 @@ def test_app_server_runs_code_mode_through_python_sdk(
             sandbox=Sandbox.workspace_write,
         ).run("run package smoke")
         assert turn.final_response == "Done", turn
+    # The mock also records analytics POSTs, which have no Responses input list.
     output = next(
         item
         for request in responses_server.requests()
+        if request.path == "/v1/responses"
         for item in request.input()
         if item.get("type") == "custom_tool_call_output"
         and item.get("call_id") == "package-smoke"