`security find-identity -v` was intermittently not seeing the imported
Developer ID Installer cert on the GitHub Actions macos-latest runner,
causing the .pkg to ship unsigned and Apple notary to reject it. Gate the
codesign / productsign branches on the env-var presence (which is what the
keychain bootstrap already gated on) instead.
Also surface notary rejection details on failure via `xcrun notarytool log`.
gin's loadDirectory() doesn't recurse, and the legacy BinaryData flow stored
presets flat in the user dir. Installer/build.sh now stages a flat copy under
Installer/_flat_presets/ which the Inno Setup script and macOS pkg both
consume; CMakeLists installs the same flat set on Linux.
Replaces the zip-based ci/build.sh flow with installer outputs (Inno Setup
on Windows, productbuild on macOS, cpack DEB on Linux) signed via Microsoft
Trusted Signing on Windows and Apple Developer ID on macOS.
Plugin code: factory wavetables and presets now ship as files via the
installer rather than embedded BinaryData. PluginProcessor implements
getProgramDirectory/getFactoryProgramDirectories so gin scans factory
content from systemResourceRoot. First-run migration copies any presets
from the legacy com.socalabs/Wavetable/programs path into the new user
dir under Library/Audio/Presets/SocaLabs/Wavetable.
Bumps gin submodule to match Identity for getFactoryProgramDirectories
support.
