[macos-runner] Unlock login keychain explicitly before fastlane signing steps

act_runner's launchd daemon now runs as loverde_vm_mac (UserName set),
but its background session doesn't inherit the unlock state from an
interactive SSH session - the login keychain is still locked when
fastlane/sigh looks for signing identities, so none are found. Unlock it
explicitly at the start of each signing job instead.

.gitea/workflows/release.yml

@@ -54,6 +54,9 @@ jobs:
           }
           EOF
 
+      - name: Unlock keychain
+        run: security unlock-keychain -p "${{ secrets.MAC_KEYCHAIN_PASSWORD }}" ~/Library/Keychains/login.keychain-db
+
       - name: fastlane release
         run: |
           cd Darwin