v0.65.1 — Release pipeline fix

Patch release of v0.65.0. All v0.65.0 functional changes apply — see v0.65.0 release notes for the SR-001..SR-024 security-hardening details and pre-deploy checklist.

What changed since v0.65.0

• fix(release): drop spctl -a -t exec check on raw Mach-O agent binaries (#598). The verification step added in PR #568 ran a bundle-aware Gatekeeper assessment against raw command-line binaries, which Gatekeeper always rejects ("the code is valid but does not seem to be an app"). The actual signing and notarization pipeline always succeeded. Replaced the bogus check with codesign --verify --strict + hardened-runtime + Authority check; .pkg-level checks unchanged.

Why a patch release was needed

v0.65.0's API + Web Docker images built and published successfully, but the macOS signing pipeline's self-verification step incorrectly failed, triggering the Release Integrity Gate and skipping the binaries init image build. v0.65.1 reruns the pipeline end-to-end with the verification fix, producing all artifacts (API/Web/binaries Docker images, macOS .pkgs, Windows .msi).

Full Changelog: v0.65.0...v0.65.1