fix(ci): use team ID for notarytool keychain profile name

[ErikBjare]

Problem

The v0.14.0b2 re-run (29498340371) got past signing after the CERTIFICATE_MACOS_P12_BASE64 secret was rotated to the new 2025 Developer ID cert, but then failed in notarization:

Error: 5 unexpected arguments: 'ID', 'Application:', 'Erik', 'Bjareholt', '(***)'

Since #1337, APPLE_PERSONALID is derived from security find-identity and holds the full identity string (Developer ID Application: Erik Bjareholt (TEAMID)) instead of the short repo secret it used to be. notarize.sh used it unquoted as part of the notarytool keychain profile name, so the spaces word-split into stray arguments and every store-credentials/submit call failed. This was masked until now because the expired cert made the job fail before reaching notarization.

Fix

• Base the keychain profile name on APPLE_TEAMID (no spaces, stable) instead of APPLE_PERSONALID.
• Quote the notarytool arguments in run_notarytool.

Context

Part of unblocking the v0.14.0b3 beta (see #1339 and the beta blocker tracker). The notarization path itself only runs on v* tags, so CI here can't exercise it; verified the word-splitting logic locally.

[ErikBjare]

@greptileai review

[greptile-apps]

Greptile Summary

This PR fixes the macOS notarization profile used by release builds. The main changes are:

• Uses APPLE_TEAMID for the stable keychain profile name.
• Quotes credentials, artifact paths, and profile names passed to notarytool.

Confidence Score: 5/5

This looks safe to merge.

• The release workflow validates and supplies APPLE_TEAMID before notarization.
• Credential storage, submission, and log retrieval use the same profile name.
• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
scripts/notarize.sh	Uses the validated team ID for the notarytool profile and quotes the changed command arguments consistently.

_{Reviews (1): Last reviewed commit: "fix(ci): use team ID for notarytool keyc..." | Re-trigger Greptile}

[greptile-apps]

Greptile Summary

This PR fixes the macOS notarization credential profile.

• Uses the Apple Team ID for the keychain profile name.
• Quotes credential, submission, artifact, and log arguments passed to notarytool.

Confidence Score: 5/5

This looks safe to merge.

• The release workflows validate that the Team ID is present.
• The same profile name is used for credential storage, submission, and log retrieval.
• No blocking issues were found in the changed code.

Important Files Changed

Filename	Overview
scripts/notarize.sh	Uses one stable, safely quoted keychain profile across credential storage, notarization submission, and rejection-log retrieval.

_{Reviews (2): Last reviewed commit: "fix(ci): use team ID for notarytool keyc..." | Re-trigger Greptile}