- Bundle cert + generated key into a password-protected .p12 file
using go-pkcs12 (legacy 3DES for macOS Keychain compatibility)
- Import the .p12 via `security import` so cert and key are properly
paired as an identity in the login keychain
- Auto-download and install the Apple WWDR G3 intermediate cert to
ensure a valid codesigning trust chain
- Change `appstore cert rm` ID from a flag to a positional argument
- Fix missing `Content-Type` header on bundle ID registration request
- Add `GetBundleIDByIdentifier` to filter bundles by reverse-DNS
identifier via the API query param instead of fetching by resource ID
- Auto-register missing bundle IDs during profile provisioning
- Stop deleting cert/key files on profile step failure; the cert
already exists on Apple's servers so destroying the private key
would make it permanently unusable — warn with recovery instructions
instead
blacktop