docs: document macOS Gatekeeper workaround for unsigned binaries

Pre-built release binaries aren't Apple-notarized, so macOS quarantines a
downloaded copy and reports it as malware. Document the one-line
`xattr -d com.apple.quarantine` fix (and the go install alternative) in the
README and in every auto-generated release's notes.

Author: ashishxcode

.github/workflows/release.yml

@@ -30,3 +30,22 @@ jobs:
         with:
           files: dist/*
           generate_release_notes: true
+          body: |
+            ## Install
+
+            **Recommended (no warnings):**
+            ```bash
+            go install github.com/ashishxcode/commit-chronicle/cmd/commit-chronicle@latest
+            ```
+
+            **Pre-built binary:** download for your OS/arch below, then:
+            ```bash
+            chmod +x commit-chronicle-*
+            # macOS only — clear the Gatekeeper quarantine flag:
+            xattr -d com.apple.quarantine commit-chronicle-* 2>/dev/null || true
+            mv commit-chronicle-* /usr/local/bin/commit-chronicle
+            ```
+
+            > macOS can't verify these binaries (they aren't Apple-notarized), so a
+            > downloaded copy is quarantined and reported as "malware" / "cannot be
+            > opened" until you run the `xattr` command above (or right-click → Open).

README.md

@@ -25,6 +25,11 @@ For a window you choose, it gathers **everything you did**:
 
 ## Install
 
+> **macOS users:** prefer Option 1 or 2 — building locally is never blocked by
+> Gatekeeper. The pre-built release binaries (Option 3) are not Apple-notarized,
+> so macOS will quarantine a downloaded copy and warn it "cannot be opened" /
+> "is malware"; clearing that takes one command (shown below).
+
 ### Option 1 — `go install` (needs Go 1.25+)
 
 ```bash
@@ -54,10 +59,18 @@ Grab the binary for your OS/arch from the
 [Releases](https://github.com/ashishxcode/commit-chronicle/releases) page, then:
 
 ```bash
-chmod +x commit-chronicle-*        # macOS/Linux
+chmod +x commit-chronicle-*                          # macOS/Linux
+xattr -d com.apple.quarantine commit-chronicle-* 2>/dev/null || true  # macOS only
 mv commit-chronicle-* /usr/local/bin/commit-chronicle
 ```
 
+The `xattr` line clears the Gatekeeper quarantine flag macOS adds to anything
+downloaded from the internet — without it you'll get a "cannot be opened
+because Apple cannot check it for malicious software" / malware warning, because
+the binaries aren't notarized. (You can also right-click the binary in Finder →
+**Open** the first time.) If you'd rather avoid this entirely, install with
+`go install` (Option 1), which compiles on your machine and is never quarantined.
+
 Maintainers can produce all platform binaries with `make release` (output in
 `dist/`).