fix(release): publish binaries despite partial build failures

The Binary Release workflow stopped producing any GitHub Release assets
because every release had at least one failing build leg, and the
github-release job (needs: all four builds, no if:) was skipped whenever
any leg failed — suppressing even successfully-built platforms.

Root causes fixed:
- github-release: add `if: !cancelled()` + zero-artifact guard so a single
  failing leg yields a partial release instead of none.
- setup-node-pnpm cache key: add runner.arch. runner.os is only
  Linux/macOS/Windows, so arm64 runners restored x64 node_modules missing
  native deps (@rollup/rollup-linux-arm64-gnu), crashing `pnpm build`.
- macOS CLI sign step: guard on APPLE_CERTIFICATE_BASE64 so unsigned
  binaries still publish when certs are absent; add timeout-minutes: 30 to
  build-binaries to avoid 24h runner hangs.
- dependency-graph plugin: replace unix cp/mkdir -p (failed on Windows
  cmd.exe) with a cross-platform node copy script.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/actions/setup-node-pnpm/action.yml

@@ -30,7 +30,10 @@ runs:
         cache: pnpm
         registry-url: ${{ inputs.registry-url }}
 
-    # Cache node_modules only for the exact pnpm-lock.yaml hash and Node/OS tuple.
+    # Cache node_modules only for the exact pnpm-lock.yaml hash and Node/OS/arch tuple.
+    # runner.arch is essential: pnpm only installs the current platform's optional
+    # native deps (e.g. @rollup/rollup-linux-arm64-gnu), so an x64 cache restored on
+    # an arm64 runner (same runner.os) would be missing native binaries and break builds.
     # Intentionally no restore-keys fallback: partial restores can create inconsistent trees.
     - name: Cache node_modules
       id: node-modules-cache
@@ -41,7 +44,7 @@ runs:
           node_modules
           **/node_modules
           !**/.cache
-        key: node-modules-${{ runner.os }}-node${{ inputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}
+        key: node-modules-${{ runner.os }}-${{ runner.arch }}-node${{ inputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}
 
     - name: Install dependencies
       if: ${{ inputs.skip-install != 'true' && steps.node-modules-cache.outputs.cache-hit != 'true' }}