fix service restart: add codesign and make deploy target

macOS kills unsigned binaries, so numa service restart failed after
copying a new build. Added ad-hoc codesign to restart flow and a
make deploy target that handles the full build-copy-sign-restart cycle.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Makefile

@@ -1,4 +1,4 @@
-.PHONY: all build lint fmt check test clean
+.PHONY: all build lint fmt check test clean deploy
 
 all: lint build
 
@@ -18,3 +18,11 @@ test:
 
 clean:
 	cargo clean
+
+deploy:
+	cargo build --release
+	sudo cp target/release/numa /usr/local/bin/numa
+	sudo codesign -f -s - /usr/local/bin/numa
+	sudo kill $$(pgrep -f /usr/local/bin/numa) 2>/dev/null || true
+	@sleep 1
+	@dig @127.0.0.1 google.com +short +time=3 > /dev/null && echo "Service restarted successfully" || echo "Warning: DNS not responding yet"

src/system_dns.rs

@@ -434,10 +434,17 @@ pub fn restart_service() -> Result<(), String> {
             .output();
         match output {
             Ok(o) if o.status.success() => {
+                eprintln!("  Tip: use 'make deploy' instead — handles codesign + restart.\n");
+                // Codesign, then kill service. Launchd KeepAlive respawns it.
+                // This will kill us too (we ARE /usr/local/bin/numa), so
+                // codesign and print output first.
+                let _ = std::process::Command::new("codesign")
+                    .args(["-f", "-s", "-", "/usr/local/bin/numa"])
+                    .output(); // use output() to suppress codesign stderr
+                eprintln!("  Service restarting → {}\n", version);
                 let _ = std::process::Command::new("pkill")
                     .args(["-f", "/usr/local/bin/numa"])
                     .status();
-                eprintln!("  Service restarting → {}\n", version);
                 Ok(())
             }
             _ => Err("Service is not installed. Run 'sudo numa service start' first.".to_string()),