Preserve the provisioned macOS CLI's code-signing identity (#46495)

## Why

Existing login-keychain access rules identify the CLI as `codex`. Packaging it in an app bundle must preserve that code-signing identifier independently of the bundle identifier and provisioned App ID.

## What changed

- Sign the provisioned CLI with the identifier `codex`, retaining `com.openai.codex.cli` as its bundle identifier.
- Require the expected signing identifier and team during signature verification, and reject unexpected bundle identifiers, executable names, or package types.
- Document the identity distinction and keychain compatibility limits.

## Testing

Extend signing-driver tests to check the signing identifier, verification requirement, bundle metadata, and provisioned entitlements, and to reject altered bundle identity fields. These tests use generated credentials and stubbed native tools; they do not verify runtime keychain access or credential recovery.

GitOrigin-RevId: ab00072e48189551adb0e70008210fee6d36241d

.github/scripts/macos-signing/sign_macos_code.sh

@@ -227,8 +227,7 @@ sign_with_rcodesign() {
     rcodesign_args+=(--binary-identifier "$identifier")
   fi
 
-  rcodesign_args+=("$target")
-  rcodesign "${rcodesign_args[@]}"
+  rcodesign "${rcodesign_args[@]}" "$target"
 }
 
 case "${OAI_CODESIGN_BACKEND:-codesign}" in