Fix Keychain persistence in production builds

[hubab1]

Summary

• Fall back to the encrypted macOS login Keychain only when the Data Protection Keychain reports a missing entitlement.
• Preserve an existing login-Keychain item unless migration to the protected store actually succeeds.
• Add regression coverage for Release behavior and safe migration.
• Prepare OpenASO 0.4.4 (build 10).

This fixes the production credential-saving failure reported in #83.

The signing and provisioning configuration is intentionally unchanged; adding a restricted Keychain entitlement is outside this hotfix.

Validation

• Relevant focused tests — 40 tests passed.
• Full test suite — 686 tests in 60 suites passed.
• Launch smoke check — a Developer ID-signed Release build saved credentials, relaunched without credential environment variables, reloaded the Keychain item, and verified successfully again.
• git diff --check origin/main...HEAD

Review State

• Ready for review

Source and Credit

Fixes #83. This is an independent implementation based on reproducing the reporter's production failure and probing both macOS Keychain implementations.