PR #21151 - manaflow-ai/cmux

Summary

Follow-up to #21145 (cmuxterm-hq#2053). The real macOS import test (tests/test_signing_keychain_real_import.sh, from #21142) now builds its throwaway .p12 with the vendored Apple Developer ID G2 intermediate in the chain, as the CI certificate secret has. The real scripts/ci/signing-keychain.sh create then runs the real scripts/import-apple-developer-id-intermediates.sh against a keychain that already holds that intermediate. That is the path that failed in the first main nightly after #21043 (run 38857402565).

No secret: the identity is self-signed and made in the job; the workflow has no environment and contents: read.

Testing

Red before #21145 (main tip then): https://github.com/manaflow-ai/cmux/actions/runs/38861491788 shows DeveloperIDG2CA.cer: already in cmux-real-import-test-1149.keychain, then FAIL: signing-keychain.sh create failed.
Green on #21145's fix (same test on feat-cmux-next, which has the same fix as #21143): https://github.com/manaflow-ai/cmux/actions/runs/38864400339 shows DeveloperIDG2CA is already in cmux-real-import-test-1191.keychain (SHA-1 5B45F61068B29FCC8FFFF1A7E99B78DA9E9C4635), then PASS.
This PR's own run of the workflow is in the checks.

Changelog

none

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Makes the real macOS signing import test carry the vendored Apple Developer ID G2 intermediate in its throwaway .p12, matching the CI certificate secret. This reproduces the nightly failure from #21043 where the intermediates step met the G2 intermediate already in the keychain, and the test now asserts it took that path so the fix is actually verified.

Summary by CodeRabbit

Tests
- Expanded signing-keychain checks to cover importing an identity that includes the Developer ID G2 intermediate certificate and verify that the intermediate is already present in the keychain.
- Test output is now shown when creation succeeds, and failures include the captured log to make the result easier to diagnose.