fix(release): publish binaries despite partial build failures

The Binary Release workflow stopped producing any GitHub Release assets
because every release had at least one failing build leg, and the
github-release job (needs: all four builds, no if:) was skipped whenever
any leg failed — suppressing even successfully-built platforms.

Root causes fixed:
- github-release: add `if: !cancelled()` + zero-artifact guard so a single
  failing leg yields a partial release instead of none.
- setup-node-pnpm cache key: add runner.arch. runner.os is only
  Linux/macOS/Windows, so arm64 runners restored x64 node_modules missing
  native deps (@rollup/rollup-linux-arm64-gnu), crashing `pnpm build`.
- macOS CLI sign step: guard on APPLE_CERTIFICATE_BASE64 so unsigned
  binaries still publish when certs are absent; add timeout-minutes: 30 to
  build-binaries to avoid 24h runner hangs.
- dependency-graph plugin: replace unix cp/mkdir -p (failed on Windows
  cmd.exe) with a cross-platform node copy script.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/fusion-plugin-dependency-graph/package.json

@@ -15,7 +15,7 @@
     }
   },
   "scripts": {
-    "build": "tsc && cp src/*.css dist/ && mkdir -p dist/styles && cp src/styles/*.css dist/styles/",
+    "build": "tsc && node scripts/copy-css.mjs",
     "pretest": "node ../../scripts/ensure-test-artifacts.mjs",
     "test": "vitest run --silent=passed-only --reporter=dot"
   },