ci(bar): auto-build and publish CCS Bar on main via self-hosted macOS runner

Releasing the macOS bar app was fully manual (run package_app.sh on a Mac, then
gh release upload --clobber), so Swift-side changes never reached users until
someone remembered to rebuild and re-upload the floating ccs-bar-latest asset.

Add a tightly-scoped Bar Release workflow that does it automatically:
- triggers ONLY on push to main touching macos-bar/**, or manual dispatch, so
  regular PRs, dev pushes, and non-bar changes never start it
- runs ONLY on the dedicated self-hosted macOS runner (label ccs-bar); the Linux
  CI runners never match it and it never competes for them
- least-privilege contents:write, single-flight via concurrency

Version is sourced from a new macos-bar/VERSION single-line file (the workflow
reads it; the asset is always the latest build regardless). package_app.sh now
defaults to that file when no version arg is passed, so the local manual path and
CI share one source of truth. Documents the release process in docs/ccs-bar.md.

macos-bar/Scripts/package_app.sh

@@ -13,12 +13,19 @@
 #   CCS_BAR_SIGNING=developer-id CCS_BAR_SIGN_IDENTITY="Developer ID Application: ..." ./Scripts/package_app.sh 0.1.0
 set -euo pipefail
 
-VERSION="${1:-0.0.0}"
 SIGNING="${CCS_BAR_SIGNING:-adhoc}"
 APP_NAME="CCS Bar"
 EXEC_NAME="CCSBar"
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+# Version precedence: explicit arg, else the committed `VERSION` file (the single
+# source of truth shared with the Bar Release CI workflow), else 0.0.0.
+VERSION="${1:-}"
+if [[ -z "$VERSION" && -f "$ROOT/VERSION" ]]; then
+  VERSION="$(tr -d '[:space:]' < "$ROOT/VERSION")"
+fi
+VERSION="${VERSION:-0.0.0}"
 DIST="$ROOT/dist"
 APP="$DIST/$APP_NAME.app"