sign-macos.sh signs neotalk.app with the Developer ID under the hardened runtime; release-macos.sh builds, signs, notarizes, staples and can publish the zip to the Gitea releases page. Credentials are read from the environment.
