#21143 ci: accept a Developer ID intermediate that the signing .p12 already added

Summary

Since a2380e75 / #21043 the signing .p12 import succeeds and adds the Developer ID G2 intermediate that the certificate carries. scripts/import-apple-developer-id-intermediates.sh then runs security add-certificates for the same certificate, which exits 1 with already in build.keychain. Every "Import signing cert" step fails: main nightly run 38857402565 on d16b03c6 failed on all 3 arches this way.

add_intermediate now treats only the already in result as success. Any other add-certificates error still fails, and the existing count check still requires both Developer ID intermediates in the keychain.

Verification

• bash -n passes.
• The real proof is the next signing run (nightly-next on this commit). tests/test_signing_keychain_real_import.sh uses a self-signed identity without the Apple intermediate, so it does not reproduce this case.

Changelog

none

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the Apple Developer ID intermediate import step so CI signing no longer fails when the signing .p12 already carries the intermediate.

• security add-certificates now treats only the already in message as success, and only when the keychain holds the exact certificate (verified by a SHA-1 fingerprint, required to be a valid 40-hex value, matched as a fixed string); any other error still exits 1.
• The script still verifies both intermediates end up in the keychain.