macOS kills unsigned binaries, so numa service restart failed after
copying a new build. Added ad-hoc codesign to restart flow and a
make deploy target that handles the full build-copy-sign-restart cycle.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>