fix: use native macOS Keychain backend

[zzwong]

Summary

• replace the macOS /usr/bin/security subprocess backend with modern Security.framework SecItem* calls
• preserve the existing coned-cli service/account identifiers and go-keyring base64/legacy-hex value compatibility
• add fail-closed Darwin no-CGO behavior and retain the existing go-keyring backend on non-Darwin platforms
• add gated live macOS Keychain integration coverage, including 16 KiB values and exact cleanup verification
• build Darwin release archives natively with CGO on Intel and arm64 macOS runners, then aggregate, validate, checksum, attest, and publish once

Root cause

go-keyring v0.2.8 writes macOS secrets through /usr/bin/security -i, whose command input is capped at 4096 bytes. A browser-authenticated Con Edison session can exceed that limit, so authentication succeeds but persistence fails. Calling the native Security.framework APIs removes that command-size boundary.

Compatibility and safety

• service remains coned-cli
• account encoding remains base64.RawURLEncoding(profile) + "/" + base64.RawURLEncoding(key)
• existing raw, go-keyring-base64:, and go-keyring-encoded: values remain readable
• OSStatus failures are sanitized; only not-found remains distinguishable
• update/add duplicate races use one bounded retry
• Darwin builds without CGO fail closed instead of falling back to another store

Validation

• GOTOOLCHAIN=go1.25.12 go test -race -shuffle=on ./...
• GOTOOLCHAIN=go1.25.12 go vet ./...
• GOTOOLCHAIN=go1.25.12 govulncheck ./... — no vulnerabilities found
• live CONED_KEYCHAIN_TEST=1 suite on macOS, including exact cleanup after a forced child-test failure
• Darwin arm64/amd64 no-CGO builds and Windows amd64 build
• all three goreleaser check configurations
• Linux and native Darwin arm64 snapshot archive/content/architecture/build-metadata inspection
• workflow YAML parsing, formatting, and git diff --check
• independent Terra xhigh security review: approved with no findings
• independent Terra xhigh verification: verified

The native Darwin amd64 build and complete artifact aggregation/publication path are intentionally exercised by GitHub Actions on macos-15-intel and the gated publish job.