release: spctl gate only hard-fails when the build was notarized

Un-notarized fallback builds (Apple Development identity) are rejected by
spctl by design; the script must still publish them with a warning, otherwise
the fallback path can never release.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

scripts/publish-update.sh

@@ -359,8 +359,11 @@ SPCTL_STATUS=$?
 set -e
 echo "${SPCTL_OUTPUT}"
 if [[ "${SPCTL_STATUS}" -ne 0 ]] || ! grep -qi 'accepted' <<<"${SPCTL_OUTPUT}"; then
-    echo "spctl did not report accepted for ${APP_BUNDLE}." >&2
+    if [[ "${NOTARIZED}" == "true" ]]; then
+        echo "spctl did not report accepted for ${APP_BUNDLE} although it was notarized." >&2
         exit 1
+    fi
+    echo "WARNING: Gatekeeper does not accept this build (not notarized). First install on other Macs needs right-click > Open." >&2
 fi
 
 TEAM_IDENTIFIER="$(codesign -dv "${APP_BUNDLE}" 2>&1 | awk -F= '/^TeamIdentifier=/{print $2}')"