feat(build): add Mac App Store (mas) target alongside Developer ID

[julia-kafarska]

What

Adds a sandboxed Mac App Store build path without disturbing the existing DMG / Developer ID distribution. Both channels build from the same config.

Changes

electron-builder.json

• mas: sign the app with the Apple Distribution identity and reference the embedded provisioning profile (build-resources/embedded.provisionprofile). The installer cert (3rd Party Mac Developer Installer) is auto-detected — electron-builder 26 exposes no field for it. App Sandbox entitlements (entitlements.mas.plist + .inherit.plist) were already in place.
• Removed the redundant ffmpeg-static extraResources copy. The app runs the asarUnpack'd binary (which electron-builder already signs — verified TeamIdentifier=8Y2UTZ2NBZ), so this only dropped ~45 MB of unused, duplicate executable from every build.
• appId → io.out-loud.outloud to match App Store Connect / the provisioning profile.

scripts/verify-mas-build.mjs (new)

• Post-build smoke-test asserting the bundle is store-ready: Apple Distribution signature, App Sandbox entitlement, embedded profile w/ matching team, every nested Mach-O (incl. ffmpeg) signed + com.apple.security.inherit, codesign --verify --deep --strict, and not hardened.

package.json

• Added verify:mas; chained it onto electron:build:mas so the build self-verifies before you ever open Transporter.

Not changed (already correct)

• Auto-update: the app uses a custom GitHub-releases poller, not electron-updater, and it's already disabled under process.mas — no change needed.
• The Developer ID / DMG signing, notarization flow, and entitlements are untouched apart from the shared appId.

Before merging / releasing

1. Place the profile at build-resources/embedded.provisionprofile.
2. Confirm App Store Connect is registered under io.out-loud.outloud.
3. npm run electron:build:mas → .pkg in releases/macos/ (self-verifies).
4. Install the .pkg locally and confirm mp3 export / speed-change work under the real sandbox, then upload via Transporter.

⚠️ The appId change affects the DMG channel's app identity too — existing DMG users' app data/update continuity resets. This was an intentional, explicitly-approved decision.