fix(phase4): set the default keychain for the macOS runner job

notarytool resolves its credential profile through the session DEFAULT
keychain, but a launchd runner job has no default keychain set, so
notarization failed with "No Keychain password item found for profile" even
though code signing (which uses the search list) succeeded. After the hook's
trust validation passes, set the dedicated account's login keychain as the
default and search keychain and unlock it, on macOS only.

The keychain password is read from a machine-local file owned by the runner
account ($HOME/.config/1helm/mac-keychain-password); it is never committed to
this repository or exported into the job environment. No sudo, no elevation.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: gitcommit90

ops/platform-acceptance/runner-job-started.sh

@@ -30,3 +30,22 @@ if not (
 ):
     raise SystemExit("Phase 4 runner refused an untrusted repository/ref/SHA/CI event.")
 PY
+
+# macOS only: prepare the dedicated signing account's login keychain for this
+# now-validated, trusted job. Code signing resolves its identity through the
+# keychain search list, but notarytool resolves its credential profile through
+# the session DEFAULT keychain, and a launchd runner job otherwise has no
+# default keychain, so notarization fails with "No Keychain password item
+# found". Set login as the default (and search) keychain and unlock it. The
+# password is read from a machine-local file owned by the runner account; it is
+# never stored in this repository or exported into the job environment.
+if [[ "$(uname)" == "Darwin" ]]; then
+  kc="$HOME/Library/Keychains/login.keychain-db"
+  kc_pw_file="$HOME/.config/1helm/mac-keychain-password"
+  if [[ -f "$kc" && -r "$kc_pw_file" ]]; then
+    security list-keychains -d user -s "$kc" /Library/Keychains/System.keychain >/dev/null 2>&1 || true
+    security default-keychain -d user -s "$kc" >/dev/null 2>&1 || true
+    security set-keychain-settings "$kc" >/dev/null 2>&1 || true
+    security unlock-keychain -p "$(cat "$kc_pw_file")" "$kc" >/dev/null 2>&1 || true
+  fi
+fi