fix(sign): provision macOS platform passkeys

Author: shadowfax92

packages/browseros/.env.example

@@ -11,6 +11,9 @@ MACOS_CERTIFICATE_NAME=
 PROD_MACOS_NOTARIZATION_APPLE_ID=
 PROD_MACOS_NOTARIZATION_TEAM_ID=
 PROD_MACOS_NOTARIZATION_PWD=
+# Local path to BrowserOS's Developer ID provisioning profile. The profile
+# must authorize the public-key-credential entitlement and BrowserOS groups.
+PROD_MACOS_BROWSEROS_PASSKEY_PROFILE_PATH=
 
 # Cloudflare R2
 R2_ACCOUNT_ID=

packages/browseros/bos_build/lib/env.py

@@ -24,6 +24,7 @@
         "MACOS_CERTIFICATE_PWD",
         "MACOS_KEYCHAIN_PASSWORD",
         "POSTHOG_API_KEY",
+        "PROD_MACOS_BROWSEROS_PASSKEY_PROFILE_B64",
         "PROD_MACOS_NOTARIZATION_PWD",
         "R2_SECRET_ACCESS_KEY",
         "SENTRY_AUTH_TOKEN",
@@ -121,6 +122,11 @@ def macos_notarization_password(self) -> Optional[str]:
         """App-specific password for macOS notarization"""
         return os.environ.get("PROD_MACOS_NOTARIZATION_PWD")
 
+    @property
+    def macos_browseros_passkey_profile_path(self) -> Optional[str]:
+        """Developer ID profile authorizing BrowserOS platform passkeys."""
+        return os.environ.get("PROD_MACOS_BROWSEROS_PASSKEY_PROFILE_PATH")
+
     @property
     def macos_keychain_password(self) -> Optional[str]:
         """macOS login keychain password (used to unlock keychain on build servers)"""