A workflow invoked with `uses:` gets no secrets unless they are passed to
it, so every secret was empty inside release.yml when tag-on-version-bump
called it. The certificate import was skipped, the build came out ad-hoc,
and the release published that way — the precise outcome signing exists
to prevent.
Its own ad-hoc guard didn't catch it either: that guard only fires when
an identity was configured, and from the called workflow's point of view
none was. So the failure was silent in both places at once, and the run
went green.
Verified against the 0.0.9 build, whose log shows an empty
SIGNING_IDENTITY and Signature=adhoc on the published artifact.
Claude Opus 5andbdeshi
150a2394dd