Release packaging fails to code-sign on the runner (errSecInternalComponent); no zip since v1.6.2

[evandhoffman]

What happens

Every release since v1.6.2 (Sep 5, the last one with a zip) fails packaging, so
v1.6.3 and v1.7.0 are tagged and released but have no zip asset. The tag
job succeeds; Package / Build and zip monitor.app fails at code-signing:

Signing as Developer ID Application: EVAN DAVID HOFFMAN (94S5PZTVPY)…
.build/monitor.app: replacing existing signature
.build/monitor.app: errSecInternalComponent
error: could not sign .build/monitor.app as Developer ID Application

Cause

errSecInternalComponent on a self-hosted runner means codesign cannot use
the signing key non-interactively — the key's partition list no longer grants
access to the tool, which a macOS update resets (the runner is now on Swift
6.3.3, so it was updated). Not a code issue: make-app.sh and the staging are
fine, and a local build on another Mac signs and zips all four artifacts
(monitor.app, monitord, monitor-exporter, install-exporter.sh).

Fix (one-time, on the MacMiniM4_01 runner)

security unlock-keychain ~/Library/Keychains/login.keychain-db
security set-key-partition-list -S apple-tool:,apple: -s \
    -k '<keychain-password>' ~/Library/Keychains/login.keychain-db

Then re-run the failed packaging (or publish v1.7.0 from the UI, which re-enters
at the Package job) to attach the zip.

Optional: stop it recurring

Add a step to package.yml (guarded by SIGN_IDENTITY != '') that unlocks the
keychain and runs set-key-partition-list before the build, reading the
password from the runner's own 1Password via op read — keeping it off GitHub,
per the repo's "nothing secret passes through GitHub" rule — so an OS update no
longer breaks releases silently. Needs the runner to have op authed and the
1Password item path for the keychain password.

Related

The release:minor label on #59 did not take — that merge cut a patch (1.6.3)
instead of a minor. v1.7.0 was reached via the MonitorVersion.string escape
hatch in #60. Worth checking the label lookup in release.yml separately.