[codex] Attest release artifacts

[ygsgdbd]

Summary

• add GitHub Artifact Attestation for the final macOS release zip
• keep the existing SHA-256 checksum, Sparkle EdDSA signature, and release asset set unchanged
• document the Homebrew cask's quarantine handling and its security boundary
• update English and Chinese manual-install instructions and provenance verification guidance

User impact

Homebrew installs can launch directly through the custom cask behavior, while the README remains explicit that TypeSwitch is unsigned and not notarized. Release downloads also gain GitHub build provenance that users can verify with gh attestation verify.

Validation

• rtk just check passed
• workflow YAML parsing passed
• actionlint passed after ignoring two existing unrelated findings: SC2129 in checksum generation and the existing softprops/action-gh-release@v1
• git diff --check passed

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.