The profile shipped with the app listed only the certificate whose private key
was lost with the old Mac, so it would have signed the new build without
complaint and then dropped keychain-access-groups at runtime, taking passkeys
and Touch ID with it. Regenerated against the cert we can actually sign with;
the preflight added alongside it now refuses any build where the two disagree.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014wtspwSFzZmjCx9UNPAorQ