ci: remove --keychain-password from store-credentials call

The notarize step was failing with:

  Error: Unknown option '--keychain-password'
  Usage: notarytool ... store-credentials [--verbose ...]
         [--key <key>] ... --keychain <keychain>]
  See 'notarytool ... store-credentials --help' for more
  information.

The --keychain-password flag is only valid for
'xcrun notarytool submit', not for
'xcrun notarytool store-credentials'. The store-credentials
command reads the keychain password via the keychain
authentication system instead.

The keychain is already unlocked by the import step
(security unlock-keychain -p "$KEYCHAIN_PASSWORD"
"$KEYCHAIN_PATH") and remains unlocked for 6 hours
(set-keychain-settings -lut 21600), so by the time the
notarize step runs, the keychain is accessible without
re-supplying the password.

Fix: drop --keychain-password from the store-credentials
invocation. Keep it on the submit invocation where it IS
valid.

Author: gilbertwong96

.github/workflows/ci.yml

@@ -437,13 +437,15 @@ jobs:
             echo "::warning::No keychain (cert secrets not set); skipping notarization."
             exit 0
           fi
+          # notarytool store-credentials doesn't accept --keychain-password;
+          # it requires the keychain to already be unlocked via
+          # `security unlock-keychain` (which the import step already did).
           echo "Recreating notarytool profile '$MACOS_KEYCHAIN_PROFILE' in temp keychain"
           xcrun notarytool store-credentials "$MACOS_KEYCHAIN_PROFILE" \
             --apple-id "$MACOS_NOTARY_APPLE_ID" \
             --team-id "$MACOS_NOTARY_TEAM_ID" \
             --password "$MACOS_NOTARY_PASSWORD" \
-            --keychain "$MACOS_KEYCHAIN_PATH" \
-            --keychain-password "$MACOS_KEYCHAIN_PASSWORD"
+            --keychain "$MACOS_KEYCHAIN_PATH"
           echo "Submitting for notarization (profile: $MACOS_KEYCHAIN_PROFILE)"
           xcrun notarytool submit "$BINARY" \
             --keychain-profile "$MACOS_KEYCHAIN_PROFILE" \