fix(ci): provision App Groups for Developer ID releases

[stors789]

Summary

Provision the main app and FinderSync extension for the registered group.cn.wflixu.RClick App Group in Developer ID releases.

RClick 2.1.0 can crash immediately on macOS 27 when SwiftData tries to create its store inside the App Group container. The shipped app and extension do not contain embedded provisioning profiles, and their final signatures do not claim the application and team identifiers needed to associate each process with an App Group-authorizing profile.

Root cause and user impact

Investigation of the affected release found:

• the App Group container URL resolves successfully;
• the SQLite database does not exist before the failing launch;
• Core Data fails while creating RClickDatabase.sqlite with NSCocoaErrorDomain Code=513 / EPERM;
• unified logging reports Sandbox access to file-write-create denied;
• ModelContainer.swift converts that initialization error into a fatalError, producing the observed SIGTRAP;
• both the released main app and FinderSync extension lack embedded.provisionprofile;
• their final signatures lack the corresponding application identifier and team identifier.

Because the store is absent and the failure occurs on the initial file creation, this is not caused by SwiftData schema migration or database corruption. It is a release-signing authorization failure.

Type of Change

• 🐛 Bug fix
• ✨ New feature
• 📝 Documentation update
• ♻️ Refactoring
• ⚡ Performance improvement
• 🔧 Build/CI change
• 🧪 Test addition/update

Changes

Release workflow

• Accept separate Developer ID provisioning profiles for cn.wflixu.RClick and cn.wflixu.RClick.FinderSyncExt.
• Select exactly one Developer ID Application identity from the temporary keychain and use its identity hash for every codesign invocation.
• Decode and validate both profiles before building the release artifact.
• Compare the Bundle ID exactly after removing the App ID prefix.
• Compare the Team ID exactly.
• Require group.cn.wflixu.RClick to be an exact element of the profile's App Group array.
• Require both profiles' DeveloperCertificates arrays to contain the actual signing certificate.
• Add the profile-provided application identifier and team identifier to each target's signing entitlements.
• Embed the matching profile in the FinderSync extension and main app before signing.
• Sign frameworks, the extension, the main app, and the DMG by identity hash to avoid same-name certificate ambiguity.
• Verify the embedded profiles, final entitlements, and nested signatures with codesign --verify --deep --strict.
• Fail the release workflow with a specific error when an identity or profile does not match.

Documentation

• Document MACOS_APP_PROVISIONING_PROFILE and MACOS_EXTENSION_PROVISIONING_PROFILE.
• Document certificate/profile matching, identity-hash signing, profile embedding, signing order, and final validation.

Related Issue

Addresses #133

Screenshots

Not applicable; this change has no UI surface.

Testing

Re-run for this PR

• Parsed .github/workflows/release.yml as YAML.
• Ran bash -n independently against all 14 workflow run scripts.
• Confirmed a valid profile fixture is accepted.
• Confirmed a profile for not.cn.wflixu.RClick is rejected.
• Confirmed an App Group containing only group.cn.wflixu.RClick.beta is rejected.
• Confirmed a profile whose DeveloperCertificates does not contain the signing identity is rejected.
• Ran git diff --check.

Prior investigation and validation (not re-run in this PR preparation)

• Xcode 27 Release build succeeded.
• Xcode 27 build-for-testing succeeded.
• Layered release-signing simulation and strict signature verification succeeded.
• A temporary-directory upgrade test from the v2.0.4 five-model store to the v2.1.0 six-model store succeeded.
• Existing records were preserved and BookmarkEntity remained writable and readable.
• The App Group ID, SQLite path, and UserDefaults suite did not change.
• No real user database was read or modified.

Required maintainer configuration

Before the Release workflow can succeed, repository maintainers must configure:

• MACOS_APP_PROVISIONING_PROFILE
• MACOS_EXTENSION_PROVISIONING_PROFILE

MACOS_CERT_P12 must contain the same Developer ID Application certificate authorized by both profiles.

Remaining release validation

This machine does not have the maintainers' GitHub Secrets, Developer ID private key, or production provisioning profiles, so a real Developer ID Release Actions run was not performed.

After producing an official artifact, maintainers should still verify:

• Developer ID signing and provisioning-profile authorization;
• notarization and ticket stapling;
• first-install launch on macOS 27;
• FinderSync extension loading;
• launch with an existing v2.0.4 data store.

Checklist

• The change is limited to the Release workflow and its CI/CD documentation.
• Documentation is updated.
• The branch is based on and targets dev.
• Official Developer ID Release Actions artifact validated with maintainer credentials.
• First-install and upgrade launch verified on macOS 27.