ci: fix MAS and direct dmg signing in release workflow

- Use separate keychains for Mac App Distribution and Installer certs
- Add missing Developer ID certificate secrets for direct .dmg job

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Your Name

.github/workflows/release.yml

@@ -137,12 +137,16 @@ jobs:
       - name: Import Mac App Distribution certificate
         uses: apple-actions/import-codesign-certs@v3
         with:
+          keychain: signing_temp_app
+          create-keychain: true
           p12-file-base64: ${{ secrets.APPLE_CERTIFICATE_MAS }}
           p12-password: ${{ secrets.APPLE_CERTIFICATE_MAS_PASSWORD }}
 
       - name: Import Mac Installer Distribution certificate
         uses: apple-actions/import-codesign-certs@v3
         with:
+          keychain: signing_temp_installer
+          create-keychain: true
           p12-file-base64: ${{ secrets.APPLE_CERTIFICATE_MAS_INSTALLER }}
           p12-password: ${{ secrets.APPLE_CERTIFICATE_MAS_INSTALLER_PASSWORD }}