Run the GitLab build graph in the pinned builder container, and package, rcodesign-sign, notarize, and DMG the macOS desktop app on Linux. iOS remains the only job that requires macOS (dispatched via MAC_HOST).