ci(macos): re-exclude keychain tests (unsigned binaries segfault in Security.framework)

Verification result: even with a created + unlocked default keychain, unsigned test binaries segfault inside Security.framework headlessly (10/140 keychain tests). Confirming them would require ad-hoc-codesigning every test exe; not worth it. Revert to excluding sync/keychain tests -> macOS green at 130 built / 106 run. The keychain path stays covered on Linux+Windows; macOS keychain is verifiable only via the signed prod app.

Author: tamlok

.github/workflows/ci-macos.yml

@@ -156,24 +156,17 @@ jobs:
         # libs) then run them headlessly via the Qt offscreen platform plugin.
         # VNOTE_BUILD_TESTS defaults to ON, so no extra -D is needed.
         #
-        # Sync/keychain tests ARE run: we create + unlock a temporary default
-        # keychain (same mechanism as the Codesign step) so the real qtkeychain
-        # Security.framework path can store/read PATs, mirroring a logged-in
-        # user's unlocked login keychain. Without this, headless macOS has no
-        # usable default keychain and the SecItem* error path throws an uncaught
-        # NSInvalidArgumentException. This both restores coverage AND verifies
-        # the macOS keychain path actually works.
+        # Sync/keychain tests are EXCLUDED on macOS. The real qtkeychain path
+        # (keychain_apple.mm + Security.framework) cannot run in CI: even with a
+        # created + unlocked default keychain, an UNSIGNED test binary segfaults
+        # inside Security.framework on a headless runner (verified — making them
+        # pass would require ad-hoc-codesigning every test exe with keychain
+        # entitlements). The platform-agnostic sync LOGIC is already covered
+        # against the real backend on Linux + Windows; the macOS keychain path
+        # is third-party and only reachable from the signed prod app.
         run: |
           set -e
           cmake --build .
-          # Unlocked, no-timeout temp keychain as the default + only search entry.
-          KEYCHAIN="${{runner.workspace}}/vnote-test.keychain-db"
-          KC_PW="vnote-test-pw"
-          security create-keychain -p "$KC_PW" "$KEYCHAIN"
-          security set-keychain-settings -lut 21600 "$KEYCHAIN"
-          security unlock-keychain -p "$KC_PW" "$KEYCHAIN"
-          security list-keychains -d user -s "$KEYCHAIN"
-          security default-keychain -s "$KEYCHAIN"
           export QT_QPA_PLATFORM=offscreen
           # Force a UTF-8 locale so std::filesystem::path round-trips through
           # std::string preserve non-ASCII bytes. Without this, CJK filenames
@@ -185,7 +178,7 @@ jobs:
           # libVTextEdit.dylib lives next to the parent build's VNote binary;
           # add it to DYLD_LIBRARY_PATH so Qt-side test exes resolve it at load.
           export DYLD_LIBRARY_PATH="${{runner.workspace}}/build/libs/vtextedit/src:${DYLD_LIBRARY_PATH:-}"
-          ctest --output-on-failure
+          ctest --output-on-failure -E '(sync|bootstrap|credential|keychain|syncinfo)'
         working-directory: ${{runner.workspace}}/build
 
       - name: Re-run failed tests with extra-verbose output (debug aid)