Use run-specific keychain names to fix parallel signing conflicts (#5665)

When multiple runners on the same machine try to sign simultaneously,
they were conflicting on the shared keychain names (build.keychain,
ios-build.keychain). This caused errSecInternalComponent errors.

Changes:
- mac_build.yml: Use build-${run_id}.keychain
- ios_testflight.yml: Use ios-build-${run_id}.keychain
- codesign_mac_app.sh: Support KEYCHAIN_NAME env var with fallback

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

scripts/codesign_mac_app.sh

@@ -6,12 +6,14 @@
 # Environment variables:
 #   SIGNING_IDENTITY - The signing identity (default: "Developer ID Application")
 #   KEYCHAIN_PASSWORD - Password to unlock the build keychain (optional)
+#   KEYCHAIN_NAME - Name of the keychain to unlock (default: "build.keychain")
 
 set -euxo pipefail
 
 APP_PATH="$1"
 ENTITLEMENTS_PATH="${2:-}"
 SIGNING_IDENTITY="${SIGNING_IDENTITY:-Developer ID Application}"
+KEYCHAIN_NAME="${KEYCHAIN_NAME:-build.keychain}"
 
 if [ ! -d "$APP_PATH" ]; then
     echo "ERROR: App not found at $APP_PATH"
@@ -20,7 +22,7 @@ fi
 
 # Unlock keychain if password provided
 if [ -n "${KEYCHAIN_PASSWORD:-}" ]; then
-    security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain || true
+    security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME" || true
 fi
 
 echo "=== Signing nested components first ==="