Darwin ARM64 packaged reprobe: preserve OS Safe Storage identity across launches

[integry]

Objective

Make the two-process packaged Connect journey pass on Darwin ARM64 from transport epic head e31a4e66a6a304b1d1f41fa3ac7d1a22d7fd6117 while continuing to use real macOS OS-backed Safe Storage.

PR #2089 is merged into the transport epic. Darwin ARM64 completes pairing, then the second packaged process fails at JOURNEY_STORAGE_BACKEND because safeStorage.isEncryptionAvailable() is false. CI successfully created, unlocked, selected, and pre-seeded the disposable keychain item, so pre-seeding alone is proven insufficient. Electron macOS Safe Storage requires a valid consistent application signing identity across launches.

Requirements

1. Diagnose the exact Electron/Keychain identity requirement on the current macOS ARM64 runner and implement the smallest deterministic CI acceptance setup. Prefer a generated disposable self-signed test signing identity or an equivalently strong consistent identity for both launches; no paid Apple account, Developer ID, notarization, or repository secret may be required for this CI smoke.
2. Keep the packaged application on the real os-protected Safe Storage backend. Do not mock Safe Storage, fall back to plaintext or basic_text, bypass the storage check, share the token through environment or argv, or collapse pair and reprobe into one process.
3. Keep signing identity, certificate material, password, keychain, and credential data ephemeral and non-logged. Restore the runner keychain list/default and delete all disposable material on every exit path.
4. Verify the packaged app has one stable designated signing identity before launch and that both pair and reprobe processes decrypt the same persisted credential. Keep exact credential plaintext scans and all existing profile/origin/identity/generation/scope fencing.
5. The setup must work on Darwin ARM64 and must not regress Darwin x64. Do not alter production release signing/notarization or Linux/Windows behavior.
6. Add source-contract and negative tests proving cleanup, no static secrets, no production-signing mutation, and failure closed when the disposable identity cannot be established.

Gates

Run the focused platform/keychain/lifecycle tests, exact platform-safe Connect 86/86, native durability 120/120, typechecks, diff and secret scans. Require fresh packaged Connect success on Darwin ARM64 and Darwin x64 and unsigned package validation on both targets.

Run Ultrafix with goal 9 before merge and leave the generated PR open for independent audit.

Integration contract

Target 1953-epic-desktop-transport-api through the base-1953-epic-desktop-transport-api label. Never target main or 1950-epic-cross-platform-dsk. Do not merge the generated PR.

Part of #1950 and #1953. Blocking #2035 and final #1970.

[propr-dev]

🤖 AI processing has started for this issue using codex agent with gpt-5.6-sol model.

I'll analyze the problem and work on a solution. This may take a few minutes.

Processing Details:

• Agent: codex
• Model: gpt-5.6-sol
• Branch: 2106/gpt-5.6-sol-darwin-arm64-packaged-rep-20260904-1325-wuu
• Base Branch: 1953-epic-desktop-transport-api
• Worktree: issue-2106-20260904-1325-gpt-5.6-sol-wuu

🔍 Track Task Execution

[integry]

Implemented by #2108, merged into 1953-epic-desktop-transport-api (34339ef). Closing the completed child issue during epic issue/PR reconciliation. Final desktop integration and delivery remain tracked by #1950 / #1970; this does not claim a main-branch release.