macOS NodeLink signing and tailnet onboarding

Goal: a Mac joins this control plane's tailnet from any prior state and keeps a NodeLink mounted across auto-updates. - Developer ID-sign (hardened runtime) and notarize every Mach-O in the darwin-arm64 bundle in CI (operator supplies the Apple credentials). - PPPC .mobileconfig for MDM Macs, and a guided Full Disk Access step in Add node for unmanaged Macs; node reports `needs_permission` and the console shows the fix. - Re-enable `shared_accounts` for macOS; update the macOS paragraph of docs/policies/nodelink.md. - A Mac on another tailnet is moved with consent (as the Ubuntu body does); operator re-enrol forces tailnet re-auth. Out of scope: daemon parity items shared with Windows (own task); Windows. Done means: CI runs `codesign --verify --strict` + `spctl -a` on the published bundle; on a real Mac after an auto-update the NodeLink stays mounted and a second node reads a token from it; rendered-body tests pin the new onboarding branches.

Built CI Developer ID signing + notarization (codesign --verify --strict + spctl), a stable signed FDA anchor, PPPC profile, Add node FDA step, needs_permission, macOS NodeLink on, Mac re-enrol re-auth. Quick gate green; PR #6644 queued. Signing is off until APPLE_TEAM_ID + secrets are set; real-Mac proof is draft #9068.