ci: fix entitlements AMFI parse error (remove XML comments)

The CI signing step was failing with:

  Failed to parse entitlements: AMFIUnserializeXML: syntax
  error near line 5

The entitlements plist was syntactically valid (plutil -lint
passed), but AMFI's XML parser (used by codesign internally) is
much stricter than plutil and rejects XML comments at the top
of the file. The big comment block at the top of
bin/ado.entitlements was triggering the parse error.

Fix: move the comment block out to bin/ado.entitlements.README.md
and keep the .entitlements file minimal (no comments, minimal
indentation). The actual entitlements stay the same:

  com.apple.security.cs.allow-jit
  com.apple.security.cs.allow-unsigned-executable-memory
  com.apple.security.cs.disable-library-validation

Verified locally: codesign --force --options runtime
--entitlements bin/ado.entitlements --sign ... succeeds
with the same Authority chain as before
(Developer ID Application: Jianbo WANG (87R27UKGSF)) and
flags=0x10000(runtime) confirming hardened runtime is enabled.

Author: gilbertwong96

bin/ado.entitlements

@@ -1,53 +1,12 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!--
-  Entitlements for the `ado` CLI binary.
-
-  Hardened Runtime is enabled via `codesign --options runtime` in
-  bin/sign.sh. Hardened Runtime restricts what a signed binary is
-  allowed to do at runtime. By default this would prevent BEAM (the
-  Erlang VM Burrito ships) from functioning, so we need to opt back
-  in to specific capabilities via entitlements.
-
-  These are the minimum entitlements a BEAM-based CLI tool needs
-  under Hardened Runtime:
-
-    - com.apple.security.cs.allow-jit
-        BEAM compiles native code at runtime (the BEAM compiler,
-        NIFs, etc.) and uses executable memory pages. The JIT
-        entitlement lets the kernel map pages with MAP_JIT on
-        Apple Silicon.
-
-    - com.apple.security.cs.allow-unsigned-executable-memory
-        Allows BEAM to allocate pages marked PROT_EXEC | PROT_WRITE
-        before writing machine code into them and flipping to
-        PROT_EXEC. Required for BEAM's loadable modules.
-
-    - com.apple.security.cs.disable-library-validation
-        Allows BEAM to dlopen() libraries that are not signed with
-        the same Developer ID team. We don't use this directly, but
-        some NIFs and Elixir libraries dynamically load shared
-        objects at runtime. Disabling library validation is the
-        standard escape hatch for "I trust my own code but I
-        dlopen() other people's libs".
-
-  These are all "runtime" entitlements (set by --options runtime);
-  the sandbox/file-access entitlements are intentionally NOT
-  requested because this is a CLI tool, not a sandboxed GUI app.
-
-  Reference:
-  https://developer.apple.com/documentation/security/hardened_runtime_entitlements
-  https://developer.apple.com/documentation/security/hardened_runtime
--->
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-    <key>com.apple.security.cs.allow-jit</key>
-    <true/>
-
-    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
-    <true/>
-
-    <key>com.apple.security.cs.disable-library-validation</key>
-    <true/>
+<key>com.apple.security.cs.allow-jit</key>
+<true/>
+<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+<true/>
+<key>com.apple.security.cs.disable-library-validation</key>
+<true/>
 </dict>
 </plist>

bin/ado.entitlements.README.md

@@ -0,0 +1,45 @@
+# Entitlements for the `ado` CLI binary
+
+This file (`bin/ado.entitlements`) is the entitlements plist used by
+`codesign` via `bin/sign.sh` and the GitHub Actions release workflow.
+
+## Why these specific entitlements?
+
+The `--options runtime` flag (hardened runtime) is enabled in
+`bin/sign.sh`. Hardened Runtime restricts what a signed binary is allowed
+to do at runtime. By default this would prevent BEAM (the Erlang VM
+Burrito ships) from functioning, so we need to opt back in to specific
+capabilities via entitlements.
+
+These are the minimum entitlements a BEAM-based CLI tool needs under
+Hardened Runtime:
+
+- `com.apple.security.cs.allow-jit` — BEAM compiles native code at
+  runtime and uses executable memory pages. The JIT entitlement lets
+  the kernel map pages with `MAP_JIT` on Apple Silicon.
+
+- `com.apple.security.cs.allow-unsigned-executable-memory` — Allows
+  BEAM to allocate pages marked `PROT_EXEC | PROT_WRITE` before
+  writing machine code into them and flipping to `PROT_EXEC`. Required
+  for BEAM's loadable modules.
+
+- `com.apple.security.cs.disable-library-validation` — Allows BEAM to
+  `dlopen()` libraries that are not signed with the same Developer ID
+  team. Some NIFs and Elixir libraries dynamically load shared
+  objects at runtime.
+
+These are all "runtime" entitlements (set by `--options runtime`);
+sandbox / file-access entitlements are intentionally **not** requested
+because this is a CLI tool, not a sandboxed GUI app.
+
+## Why no comments in the plist itself?
+
+AMFI's `AMFIUnserializeXML` parser (which `codesign` uses) is more
+strict than `plutil`. It rejects XML comments at the top of the
+entitlements file. So we keep the `.entitlements` file minimal and
+put the explanation in this sidecar README.
+
+## Reference
+
+- <https://developer.apple.com/documentation/security/hardened_runtime_entitlements>
+- <https://developer.apple.com/documentation/security/hardened_runtime>