Rebuild the libhdf5 xcframework zips without AppleDouble entries and verify codesign --strict #32

Split out of #12. PR #28 added the xcframework-url CI job, which resolves the binary targets by URL. It runs on push, schedule and workflow_dispatch. This issue covers the part of #12 that needs a Mac.

• The released libhdf5 xcframework zips carry 13 AppleDouble ._* entries. They were made with ditto, which was run without --norsrc --noextattr. Rebuild the zips clean, either with ditto -c -k --norsrc --noextattr --keepParent or with zip -X after xattr -cr, and confirm unzip -l lists no ._ entries.
• Update the URLs and checksums in xcframeworkRelease in Package.swift. Use swift package compute-checksum, not a hand edit.
• Archive one app that links FormatoHDF5 and run codesign --verify --deep --strict on it. Record the result here.

Done when: no zip contains ._* entries, the checksums in Package.swift match the new assets, the xcframework-url job is green on main, and the codesign --strict result is recorded.

Needs a session on the Mac: building the xcframework, creating the zip and running codesign.