fix service restart: add codesign and make deploy target

macOS kills unsigned binaries, so numa service restart failed after
copying a new build. Added ad-hoc codesign to restart flow and a
make deploy target that handles the full build-copy-sign-restart cycle.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Makefile

@@ -1,4 +1,4 @@
-.PHONY: all build lint fmt check test clean
+.PHONY: all build lint fmt check test clean deploy
 
 all: lint build
 
@@ -18,3 +18,11 @@ test:
 
 clean:
 	cargo clean
+
+deploy:
+	cargo build --release
+	sudo cp target/release/numa /usr/local/bin/numa
+	sudo codesign -f -s - /usr/local/bin/numa
+	sudo kill $$(pgrep -f /usr/local/bin/numa) 2>/dev/null || true
+	@sleep 1
+	@dig @127.0.0.1 google.com +short +time=3 > /dev/null && echo "Service restarted successfully" || echo "Warning: DNS not responding yet"