fix(build): tighten Touch ID build tags for cgo-disabled cross-builds

[jklaassenjc]

Summary

PR #36's workflow fix got the auto-release running again, but it failed at make dist with:

internal/mcp/stepup.go:247:11: undefined: touchIDAvailable
internal/mcp/stepup.go:314:13: undefined: newTouchIDStepUpIfSupported

Root cause: KLA-412 added stepup_touchid_darwin.go (cgo wrapper around LocalAuthentication.framework) with //go:build darwin, plus stepup_touchid_other.go with //go:build !darwin. That works for native darwin and native non-darwin builds — but cross-builds default to CGO_ENABLED=0, which silently excludes the cgo file without the stub being picked up. Cross-darwin builds (Linux runner → darwin, or local darwin/arm64 → darwin/amd64) end up with neither.

This is why every release run since KLA-412 has failed at make dist.

Fix

Tighten the tags so the stub covers cgo-disabled darwin too:

File	Old	New
stepup_touchid_darwin.go	darwin	darwin && cgo
stepup_touchid_darwin_test.go	darwin	darwin && cgo
stepup_touchid_other.go	!darwin	!darwin || !cgo
stepup_touchid_other_test.go	!darwin	!darwin || !cgo

A darwin binary built without cgo now compiles cleanly and falls back to TTY at runtime — same behavior already exhibited on Macs without Touch ID hardware. Touch ID itself only works in native cgo-enabled darwin builds, which is what make install and go install produce on developer machines anyway.

What ships after this merges

Labeled minor so the (now-working) release workflow produces v1.17.0 with auto-generated notes covering every PR since 1.16.0:

• KLA-411 — Ed25519 op-envelope signing
• KLA-412 — Touch ID step-up
• KLA-417 — Self-describing step-up errors
• KLA-404 — device_view MCP App
• KLA-405 — compliance_view MCP App
• KLA-406 — recipe_runner_view + recipe_run execute path
• KLA-413 — Webhook out-of-band approval (closes KLA-408 step-up trilogy)
• KLA-399 — Recipe edit via $EDITOR
• CI label-check + release workflow fixes

Test plan

• make dist locally produces all 5 archives (darwin amd64/arm64, linux amd64/arm64, windows amd64)
• go test ./internal/mcp/ -run "Touch|StepUp" passes natively (cgo on, darwin path exercised)
• On merge, release workflow successfully publishes v1.17.0 with all 5 binaries attached

🤖 Generated with Claude Code

---

Note

Low Risk
Build-tag-only change with no runtime logic edits; native cgo darwin builds still get real Touch ID.

Overview
Fixes release make dist failures where darwin cross-builds (CGO_ENABLED=0) compiled neither the cgo Touch ID implementation nor the non-darwin stub, leaving touchIDAvailable / newTouchIDStepUpIfSupported undefined in stepup.go.

Build tags are aligned so one path always provides those symbols: the LocalAuthentication-backed files require darwin && cgo; the stub and its tests compile for !darwin || !cgo (including cgo-disabled darwin). Runtime behavior for shipped cross-compiled darwin binaries is unchanged—TTY step-up fallback, same as Macs without Touch ID.

^{Reviewed by Cursor Bugbot for commit b442232. Bugbot is set up for automated code reviews on this repo. Configure here.}