Improvements
- Tightened macOS signing rules so passkey-related entitlements are only applied when both the Apple team ID and provisioning profile are available.
- Local macOS release builds now fail early with a clear error if passkey entitlements are requested without the required provisioning profile.
- Unified provisioning profile handling in the Forge signing configuration to make macOS release builds more consistent.