Verify macOS NodeLink across auto-update

Task 9005 shipped Developer ID signing (CI job `node-sign-macos`, off until the repo variable APPLE_TEAM_ID and the `macos-signing` environment secrets are set), the stable-path TCC anchor `/Library/Jaah/bin/jaah-anchor`, the PPPC profile and `needs_permission`. No real Mac was reachable from the runner, so the end-to-end proof is still open. Do: - Configure APPLE_TEAM_ID (repo variable) and the five APPLE_* secrets in the `macos-signing` environment; confirm a develop Jaah Deploy runs `node-sign-macos` green (codesign --verify --strict + spctl lines in its log). - On a real Mac: install a node, attach the accounts NodeLink, see `Needs permission`, grant Full Disk Access to /Library/Jaah/bin/jaah-anchor (or install the profile from Add node), see `Mounted`. - Trigger an auto-update to the next release; confirm the NodeLink stays `Mounted` with no new grant, and a second node reads an account token from it. Out of scope: Windows; any change to the signing design unless the real run shows it is broken. Done means: the Deploy log of a signed release, plus console screenshots of the Mac's NodeLink `Mounted` before and after an auto-update, and a dispatch on the second node using a token minted on the Mac.

Blocked, not verified: there is no macOS node on dev or prod and Add node can't launch one. Signing stays off by the operator's call, so there is no signed release yet. Drafts #9127 (EC2 Mac node) and #9128 (signing optional) filed; re-run 9068 after #9127. Memory: none applied.