fix: make macOS Keychain repair action-based

[rianjs]

Summary

• replace the macOS Keychain delete/recreate repair helper with a metadata-driven ACL healer
• add explicit inspect, --heal, --cleanup, and --rebuild modes; mutating runs require --apply plus one action
• add script self-test wiring, CI coverage, and scripts documentation

Safety model

• inspect and --heal dry-runs do not read secrets
• --heal --apply appends missing stable-signed app grants without reading, deleting, or recreating secrets
• --cleanup/--rebuild require explicit --apply and rebuild items only after stable app DR validation

Validation

• make check
• shellcheck scripts/repair-macos-keychain-credentials.sh
• scripts/repair-macos-keychain-credentials.sh --self-test
• scripts/repair-macos-keychain-credentials.sh --tool nrq
• scripts/repair-macos-keychain-credentials.sh --heal --tool nrq
• scripts/repair-macos-keychain-credentials.sh --cleanup --tool nrq --tool cr
• scripts/repair-macos-keychain-credentials.sh --rebuild --tool nrq
• embedded helper compile check