Raw `go build` produces unsigned binaries that macOS kills. Add a
BuiltProperly ldflag that make build sets, and check it at startup.
If missing, print an error directing users to use make build.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>