macos: ad-hoc codesign subprocess and .so to fix MachPortRendezvous failures

Chrome 130+ MachPortRendezvousServerMac validates the signature of each
connecting subprocess via process_requirement.cc. Without a valid code
signature the server rejects the connection, bootstrap_look_up returns
BOOTSTRAP_UNKNOWN_SERVICE (1102), and shared_memory_switch.cc kills the
subprocess ("No rendezvous client, terminating process").

The browser process also fails its own process_requirement check (-67030)
when it has loaded the unsigned cefpython_py*.so extension, because macOS
marks the process code signature as invalid when an unsigned library is
dlopen'd into a signed process.

Ad-hoc signing both the subprocess binary and the Python extension gives
them a valid (self-signed) code identity that process_requirement.cc
accepts, restoring normal MachPortRendezvousClient operation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: linesight

.github/workflows/ci-macos.yml

@@ -118,6 +118,12 @@ jobs:
         run: |
           cp -r build/artifacts/. cefpython3/
           chmod +x cefpython3/subprocess
+          # Ad-hoc sign binaries so macOS process_requirement.cc validation
+          # does not fail with -67030. That failure restricts the bootstrap
+          # namespace for child processes and breaks MachPortRendezvousClient
+          # bootstrap_look_up, causing all subprocesses to crash on startup.
+          codesign --force --sign - cefpython3/subprocess
+          for f in cefpython3/cefpython_py*.so; do codesign --force --sign - "$f"; done
 
       - name: Run unit tests
         run: |