Stable macOS code-signing in the reusable release workflow + darwin-gate #23

Part of the initiative to give our keychain-backed, Homebrew-distributed CLIs a stable macOS code-signing identity, so the Keychain "Always Allow" grant survives brew upgrade. Today darwin binaries are only ad-hoc signed, so the designated requirement (DR) pins a per-build cdhash that changes every release → users get re-prompted on every update. Fix: sign each darwin binary at release with one self-signed cert + a constant per-tool identifier, making the DR pin certificate leaf = H"<hash>" with no cdhash.

This is the shared-infra ticket — the 6 CLI tickets depend on this landing and v1 advancing first.

Scope

• New composite actions/macos-codesign-setup/: import cert via apple-actions/import-codesign-certs@v6; write canonical codesign-darwin.sh to $GITHUB_WORKSPACE/.ci/; export SIGN_IDENTITY, TOOL_IDENTIFIER=org.open-cli-collective.<binary>, CODESIGN_DARWIN_SCRIPT (absolute), REQUIRE_SIGNING. Called unconditionally; self-gates on inputs (all-or-none over the 4 macos-cert-* inputs; no-op when absent).
• Extend actions/darwin-gate/darwin-gate.sh with check-signature <arm> <amd> <expected-leaf> <identifier>: parse ONLY the designated => … requirement line; assert certificate leaf = H"<expected-leaf>" (case-insensitive) + identifier "<identifier>" + no cdhash. Self-gates on inputs.expected-leaf.
• Wire into .github/workflows/release.yml: 4 optional workflow_call secrets (macos-cert-p12|password|cn|leaf-sha); call both composites unconditionally (secrets via with:; never secrets.* in if:).
• Advance the rolling v1 tag.

Acceptance

• Untouched @v1 callers keep releasing unsigned (no secrets passed → composites no-op).
• When a caller passes all 4 secrets, signing and check-signature enforcement activate together (atomic).
• A built darwin binary carries DR certificate leaf = H"42e1afd0…" with no cdhash; codesign --verify --strict passes.