docs(ci): note that codesign --sign - needs no certificate

A reviewer read `codesign --force --sign -` and asked where the signing
certificate comes from. The surrounding comment explained why the re-sign
happens but never said what `-` is, so the flag reads like a placeholder for
an identity name that CI must provision.

It is the ad-hoc identity: no certificate, no keychain, no Developer ID.
Confirmed against the built artifact, which reports `Signature=adhoc` and
`TeamIdentifier=not set`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: perryqh

.github/workflows/ci.yml

@@ -150,6 +150,12 @@ jobs:
           # single coherent signature. All code on Apple silicon must be at
           # least ad-hoc signed or it is SIGKILLed on launch, so verify rather
           # than assume. https://developer.apple.com/forums/thread/708552
+          #
+          # `--sign -` is the ad-hoc identity, not a placeholder for a cert
+          # name: no certificate, no keychain, no Developer ID, nothing to
+          # provision in CI. It only makes the binary internally consistent and
+          # asserts nothing about who built it -- provenance comes from the
+          # attestation step below, not from codesign.
           codesign --force --sign - target/codeowners
           codesign --verify --verbose target/codeowners