macOS: support Touch ID for Keychain secrets

[kevinmichaelchen]

Problem

The Keychain provider can show repeated password dialogs, and “Always Allow” may not survive CLI upgrades.

Proposal

Add a signed native macOS helper that:

• gates secret reads with Touch ID and password fallback;
• caches approval briefly per terminal/app session;
• avoids interactive Keychain probes during daemon startup;
• migrates existing Executor-owned Keychain items.

Varlock’s native implementation is a useful reference.

Success

One Touch ID prompt unlocks Executor connections for a short session, without repeated password dialogs.