Rolling release runners stall or fail fetching apple-codesign releases. Ship linux-x64 and linux-arm64 binaries under tools/rcodesign/ and install from the checkout so the ad-hoc macOS signing step is offline and fast.
