Harden macOS deployment and tunnel reporting

[pzzzy]

What changed

• Register the custom signing keychain in the macOS user search list and grant codesign access to its private key.
• Sign and strictly verify the staged binary before replacing the active binary.
• Fail closed when stable signing is requested but unusable instead of silently deploying an ad-hoc signature.
• Pin the bundled cloudflared helper to 2026.7.2 with the verified Darwin arm64 binary checksum.
• Make weekly reports show the bundled connector launchd actually runs before considering a Homebrew/system copy.
• Document the signing behavior, connector upgrade/rollback flow, and the numeric IPv4 recommendation for protocol-lab runs on multi-route .local hosts.

Why

The production deployment exposed two operational gaps. macOS could list the certificate as valid while codesign still could not use its private key until the custom keychain was added to the search list and its partition ACL included codesign. The deploy helper would then fall back to ad-hoc signing after replacing the binary, which can retrigger removable-volume permissions. Separately, the weekly report showed a newer Homebrew cloudflared even though launchd was running the older bundled binary.

Validation

• ./scripts/check.sh
• bash -n scripts/*.sh
• git diff --check
• ShellCheck completed with informational pre-existing quoting notices only.
• The installer path exposed one valid identity and successfully signed/strictly verified a temporary copy on the remote Mac.
• The checksum-pinned cloudflared helper downloaded and verified 2026.7.2 locally, upgraded the production bundled connector with a timestamped rollback copy, re-established tunnel connections, and preserved public /healthz success.
• The updated weekly report completed with exit code 0 and reported bundled cloudflared 2026.7.2.