[zackees]

Selftest (with PyYAML): 1646 tests OK; local gate passed.

REL-006, partially enforced (#462; the issue stays open for obs-studio adopting the action)

New ci_lint/rules/macos_signing.py. A job is a signing job if it uses actions/app-signing-macos (local or zackees/ci.yml/...) or references one of the documented signing/notary secrets, directly or through the workflow-level env:.

• A signing job in a pull_request_target workflow is a violation, whatever its if:.
• In a pull_request/merge_group workflow:
  • with no if:, it is a violation;
  • with an if: that limits it to tag refs, release or workflow_dispatch, it passes;
  • with any other if: (including != 'pull_request'), it is needs_review.
• Local reusable workflows are scanned using the calling job's if:, as GATE-012 does.
• A signing job without environment: is needs_review, because the policy also allows repository-level secrets.

Still Candidate: checking the signing steps when a repo doesn't use the reference action, and detecting a published unsigned artifact.

Batch 18's other work landed as PRs in fleet repos, none merged by this change:

• Sweep: bump setup-soldr past v0.9.81 fleet-wide so Dylint caches save (RUST-004) #31: setup-soldr bumped to v0.9.86 in chore(ci): bump setup-soldr to v0.9.86 (Dylint caches save; zackees/ci.yml#31) FastLED/fbuild#1744, chore(ci): bump setup-soldr to v0.9.86 (Dylint caches save; zackees/ci.yml#31) reld#223 and chore(ci): bump setup-soldr to v0.9.86 (Dylint caches save; zackees/ci.yml#31) zackees/ai-tools#19. Every @v0 repo already has the fix.
• fbuild#1739/#1740/#1741: brought up to date with main, which fixed the old-base Dylint bug (fbuild#1743). #1739 also got a fix for the LOC gate and ban_std_pathbuf.