fix(release): build signed assets with Xcode 27

[ajbeck]

Summary

• run release packaging on the Xcode 27 hosted runner and fail early if another toolchain is selected
• rename the shared app scheme to QuorraApp and use it explicitly in validation and release workflows
• configure the embedded CLI for Apple Development signing in Debug and Developer ID manual signing in Release
• remove the workspace-wide signing identity override that leaked into AWS and Smithy package targets
• treat the team-prefixed macOS App Group as unprovisioned while retaining the main app profile for its restricted Keychain group
• migrate create-github-app-token v3 to the configured client ID input

Root cause

The failed v0.5.0 run used Xcode 26.6. Its global Developer ID identity override was applied to Swift package resource bundles and conflicted with the automatically signed QuorraCLI target. Xcode also tried to register the team-prefixed App Group in the main app provisioning profile. The workspace additionally exposed an ambiguous generated quorra package scheme alongside the app scheme.

Verification

• Xcode 27 Release archive succeeded using QuorraApp
• archived app and embedded CLI both report version 0.5.0
• app and CLI archive executables contain arm64 and x86_64 slices
• Xcode MCP Debug build succeeded with no reported errors
• actionlint passes
• git diff --check passes

After merge, v0.5.0 can be repackaged through the workflow dispatch release_tag input.