[thdxr]

v1 publish run 40565869462 failed in sign-cli-macos and both macOS build-electron jobs. apple-actions/import-codesign-certs rejects the empty password of the new passwordless certificate.

Signing (ported from #59768)

• Replace apple-actions/import-codesign-certs with a run step. It decodes APPLE_SIGNING_CERTIFICATE to $RUNNER_TEMP, creates build.keychain with a random password, imports with -P "", sets the partition list and adds the keychain to the search list. An if: always() step deletes the keychain, the .p12 and the .p8. The keychain name is still build.keychain, which CSC_KEYCHAIN and the CLI signing step expect.
• Use only the new credentials. Notarization goes through electron-builder with APPLE_API_KEY (the path to the .p8 written from secrets.APPLE_NOTARY_KEY), APPLE_API_KEY_ID (vars.APPLE_NOTARY_KEY_ID) and APPLE_API_ISSUER (vars.APPLE_NOTARY_ISSUER_ID). Fallbacks to APPLE_CERTIFICATE, APPLE_CERTIFICATE_PASSWORD, APPLE_API_KEY, APPLE_API_KEY_PATH and APPLE_API_ISSUER are removed.
• sign-cli-macos, sign-cli-windows, build-electron (all matrix entries) and publish now run in environment: release unconditionally. Azure login already works in the release environment on dev's release.yml.

Publish only from v1

• publish.yml: the push trigger is now v1 only. Removed ci, beta, fix/npm-native-binary-install and snapshot-*. version requires github.ref == 'refs/heads/v1', and publish requires needs.version.result == 'success', so a dispatch on any other ref publishes nothing.
• Removed beta-only logic: the opencode-beta GH_REPO, --sourcemaps, the beta OPENCODE_CHANNEL and the beta Sentry environment from publish.yml, plus the beta draft-release branch in script/version.ts.
• nix-hashes.yml: dropped the beta push trigger. The commit job only runs on v1.
• containers.yml and unlock.yml (dispatch): the job only runs on v1.
• publish-vscode.yml and publish-github-action.yml: a dispatch only runs on v1, and a tag must point at a commit that is an ancestor of origin/v1.

Checks

• actionlint reports the same findings before and after: 27 unknown blacksmith-* runner labels plus 2 existing issues in docs-locale-sync.yml and generate.yml.
• bash -n passes on every run step in the touched workflows. oxlint passes on script/version.ts.

Merging

Merging is a push to v1. It starts publish.yml with no approval, because the release environment only has a branch policy (dev and v1) and no required reviewers. That run publishes a 0.0.0-dev-<timestamp> preview to npm under the dev dist-tag. It does not create a GitHub release, Docker image, AUR package or Homebrew update. deploy.yml, generate.yml, test.yml, typecheck.yml and nix-eval.yml also run on that push.