fix: handle ad-hoc signing identity in codesign script

Fall back to "-" when EXPANDED_CODE_SIGN_IDENTITY_NAME is
"Sign to Run Locally" or empty. Also drop -o runtime flag
which requires a real identity.