#21142 ci: real macOS import test for the signing keychain tool

Summary

Follow-up to #21043 (cmuxterm-hq#2053). The fake-security case in tests/test_notarize_nightly_dmg.sh did not catch the import format failure. This adds a test that uses the real security on macOS:

• tests/test_signing_keychain_real_import.sh: makes a throwaway self-signed code-signing identity with openssl and exports a .p12 under a random password (the shape of the CI certificate secrets, but no real secret). It runs the real scripts/ci/signing-keychain.sh create, signs a binary with the imported identity (proves the import and the key partition list without a prompt), runs delete, and checks that the keychain, its state and the decoded certificate are gone. It restores the user keychain search list.
• .github/workflows/signing-keychain-macos.yml: runs that test on a fresh blacksmith-6vcpu-macos-26 runner for every push or pull request that touches the keychain tool, its guard, the intermediates or the test. No environment, no secrets, contents: read.

Testing

• Green on the fixed tool (same files, feat-cmux-next): https://github.com/manaflow-ai/cmux/actions/runs/38854032585
• Red on the old tool (throwaway branch from main before #21043, since deleted): https://github.com/manaflow-ai/cmux/actions/runs/38855152701 shows security: SecKeychainItemImport: Unknown format in import. then FAIL: signing-keychain.sh create failed.
• This PR's own run of the workflow is in the checks.

Changelog

none

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds a real macOS import test for the signing keychain tool so the import format failure fixed in the previous CI change is actually caught.

The new tests/test_signing_keychain_real_import.sh creates a throwaway self-signed identity with openssl, exports a .p12 under a random password (no real secret), runs the real scripts/ci/signing-keychain.sh create, signs a binary to prove the import and key partition list, runs delete, and verifies the keychain, state, and decoded certificate are gone. The new .github/workflows/signing-keychain-macos.yml runs it on a fresh macOS runner for pushes and PRs touching the tool, its guard, intermediates, or the test, with no secrets and contents: read only, and pins the Xcode like every other macOS job.

The test only runs on a CI runner or with CMUX_SIGNING_KEYCHAIN_REAL_TEST=1 set, so a developer Mac's login keychain can't be removed from the search list accidentally; the push trigger fires only on the two trunks main and feat-cmux-next so a PR commit doesn't run twice.

Summary by CodeRabbit

• Tests
  • Added a macOS integration test that verifies keychain creation, signing without a prompt, and cleanup.
• Chores
  • Added an automated macOS workflow to run the integration test on relevant changes, pull requests, and manual dispatch.