Sign bundled macOS helper binaries (#35264)

## Why

The macOS release workflow fetched `rg` and zsh while assembling package
archives, after the signing stage. This left the bundled helper executables
outside the workflow's signing and notarization checks.

## What changed

- Fetch, sign, notarize, and upload the pinned macOS `rg` and zsh binaries with
  the other release artifacts.
- Build package archives from those signed helpers via `--rg-bin` and the new
  `--zsh-bin` override.
- Verify the helpers' architecture, signatures, and absence of entitlements in
  the final package.

## Testing

- Cover the prebuilt zsh override and verify that package assembly preserves
  the supplied helper binaries.

GitOrigin-RevId: a3865c04fa2f0f4df32e627ee7202bc87bdc3241

.github/scripts/build-codex-package-archive.sh

@@ -10,6 +10,8 @@ Usage: build-codex-package-archive.sh \
   --archive-dir <dir> \
   [--bwrap-bin <path>] \
   [--code-mode-host-bin <path>] \
+  [--rg-bin <path>] \
+  [--zsh-bin <path>] \
   [--zsh-manifest <path>] \
   [--codex-command-runner-bin <path>] \
   [--codex-windows-sandbox-setup-bin <path>] \
@@ -56,6 +58,14 @@ while [[ $# -gt 0 ]]; do
       code_mode_host_bin_provided="true"
       shift 2
       ;;
+    --rg-bin)
+      resource_args+=(--rg-bin "${2:?--rg-bin requires a value}")
+      shift 2
+      ;;
+    --zsh-bin)
+      resource_args+=(--zsh-bin "${2:?--zsh-bin requires a value}")
+      shift 2
+      ;;
     --zsh-manifest)
       resource_args+=(--zsh-manifest "${2:?--zsh-manifest requires a value}")
       shift 2