Sign and verify macOS MCP artifacts with a stable Developer ID requirement. Reject unsigned npm reruns, verify archive integrity, and clean up the isolated CI keychain on success or failure. Closes #10715