fix: sign qmd binaries with Developer ID + hardened runtime for notarization

Apple notarization rejected qmd/qmd and qmd/vec0.dylib due to:
- Not signed with valid Developer ID certificate
- Hardened runtime not enabled

Changes:
- bundle-qmd.sh: use APPLE_SIGNING_IDENTITY + --options runtime --timestamp in CI
  (falls back to ad-hoc signing in dev when no identity is set)
- useThemeManager.test.ts: add ensure_vault_themes to mock (added by theme
  editor feature, missing from stale theme ID test mock)

scripts/bundle-qmd.sh

@@ -129,11 +129,22 @@ export class LlamaChatSession {
 export const LlamaLogLevel = { Error: 0, Warn: 1, Info: 2, Debug: 3 };
 STUB
 
-# ---------- ad-hoc code signing (macOS) ----------
+# ---------- code signing (macOS) ----------
+# In CI (APPLE_SIGNING_IDENTITY set): sign with Developer ID + hardened runtime (required for notarization)
+# In dev (no identity): ad-hoc sign to remove quarantine
 if [[ "$(uname)" == "Darwin" ]] && command -v codesign &>/dev/null; then
-  echo "Ad-hoc signing bundled binaries..."
-  codesign --force --sign - "$OUT/qmd" 2>/dev/null && echo "  ✓ qmd signed" || echo "  ⚠ qmd signing failed (non-fatal)"
-  find "$OUT/node_modules" -name "*.dylib" -exec sh -c 'codesign --force --sign - "$1" 2>/dev/null && echo "  ✓ $(basename "$1") signed"' _ {} \;
+  SIGN_ID="${APPLE_SIGNING_IDENTITY:--}"
+  if [[ "$SIGN_ID" != "-" ]]; then
+    echo "Signing bundled binaries with Developer ID: $SIGN_ID"
+    SIGN_OPTS=(--force --sign "$SIGN_ID" --options runtime --timestamp)
+  else
+    echo "Ad-hoc signing bundled binaries (dev mode)..."
+    SIGN_OPTS=(--force --sign -)
+  fi
+  codesign "${SIGN_OPTS[@]}" "$OUT/qmd" 2>/dev/null && echo "  ✓ qmd signed" || echo "  ⚠ qmd signing failed (non-fatal)"
+  while IFS= read -r -d '' dylib; do
+    codesign "${SIGN_OPTS[@]}" "$dylib" 2>/dev/null && echo "  ✓ $(basename "$dylib") signed" || echo "  ⚠ $(basename "$dylib") signing failed (non-fatal)"
+  done < <(find "$OUT/node_modules" -name "*.dylib" -print0)
 fi
 
 # ---------- summary ----------