MANUAL RUN: first signed Mac drop after Apple enrollment #1261

Once the owner has enrolled and added the APPLE_SIGNING.md step 7 secrets to the drops environment, run desktop-drop for one app (dry off, experimental) and check that the Sign and notarize the Mac binaries step says Accepted. Then on a Mac, download the binary and spctl --assess --type execute -vv it (expect source=Notarized Developer ID), and run it once to make sure the JIT entitlements are enough. The signing path from #1260 can't be tested without those credentials.