fix: make qmd/search work on fresh installs — auto-install, fix permissions, sign binaries

On fresh MacBook installs, the bundled qmd binary fails to run due to:
missing execute permissions, macOS quarantine attributes, and no fallback
when qmd is completely absent. This fix addresses all three issues:

- Runtime: ensure +x permissions and remove quarantine on bundled qmd
- Runtime: auto-install qmd via bun when binary not found anywhere
- Build: ad-hoc code-sign qmd and .dylib files in bundle-qmd.sh
- Build: create placeholder resource dirs so fresh clones build cleanly

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/bundle-qmd.sh

@@ -116,6 +116,13 @@ export class LlamaChatSession {
 export const LlamaLogLevel = { Error: 0, Warn: 1, Info: 2, Debug: 3 };
 STUB
 
+# ---------- ad-hoc code signing (macOS) ----------
+if [[ "$(uname)" == "Darwin" ]] && command -v codesign &>/dev/null; then
+  echo "Ad-hoc signing bundled binaries..."
+  codesign --force --sign - "$OUT/qmd" 2>/dev/null && echo "  ✓ qmd signed" || echo "  ⚠ qmd signing failed (non-fatal)"
+  find "$OUT/node_modules" -name "*.dylib" -exec sh -c 'codesign --force --sign - "$1" 2>/dev/null && echo "  ✓ $(basename "$1") signed"' _ {} \;
+fi
+
 # ---------- summary ----------
 echo ""
 echo "qmd bundled → $OUT/"