Use custom script to simulate “codesign --deep”

The problem is that with a bad internet connection there is a very high probability that “codesign --deep” will fail due to having to contact the timestamp server for each embedded executable object.

Long-term we probably want to sign the sub-targets as they are produced and/or link the entire thing together so that there is only a single sign target (plus embedded plug-ins).
Update shebang to explicitly call ruby 1.8
Add upload (ninja) target
Add -t/--tag option to bin/upload

Presently unused but mandatory.
Use GitHub’s (preliminary) API for uploading releases
Add credits email hash for rdwampler