MANUAL RUN: Apple-sign Agent Office (make the certificate on the other Mac), then try the auto-update #2441

About 45 minutes, your hands, on the Mac with Xcode. Part of #2392, #2282. Leaves #2392 open until step 5 passes.

Context: the update feed works (agent-office-v0.1.2 is green). What is left is signing the .app with your Apple Developer ID so a fresh download opens without a warning. The account is enrolled; the certificate and notary key are not made yet. APPLE_SIGNING.md has the detail; this is the short path.

1. Other Mac: install Xcode from the App Store and open it once. Xcode, Settings, Accounts: add your Apple Account, pick the team, Manage Certificates, +, Developer ID Application. It should then show in Keychain Access under My Certificates.
2. Back it up: in Keychain Access, right-click the Developer ID Application entry (with its key) and Export as .p12 with a strong password. Save the .p12 and password in 1Password (vault codesplitter).
3. Notary key: appstoreconnect.apple.com, Users and Access, Integrations, App Store Connect API, Team Keys, +. Name it rustybuns-notary, access Developer. Download the .p8 (once only). Note the Key ID and Issuer ID. Save all three in 1Password.
4. Hand them to GitHub as secrets in the drops environment (repo Settings, Environments, drops): APPLE_DEVELOPER_ID_P12 (base64 -i cert.p12), APPLE_DEVELOPER_ID_P12_PASSWORD, APPLE_TEAM_ID, APPLE_NOTARY_KEY_P8 (the .p8 contents), APPLE_NOTARY_KEY_ID, APPLE_NOTARY_ISSUER_ID. Tell the agent when they are set; it can check names only.
5. After the Apple-signing PR (linked from here) merges: push a new stable tag (agent-office-v0.1.3) and approve the drops run. Download the .app from agent-office-latest on a clean Mac: it should open with no warning. Then install an older build and use Check for updates in the tray: it should find and install the new one.