Fix *nix permissions and use certificate_logical_to_actual

[andyleejordan]

PR Summary

Fixes #23968 (with regression tests) and finishes the certificate code abstraction.

PR Context

In the pipelines we for reasons have to zip up the macOS and Linux builds on Windows which strips the executable permissions. We already had logic in the package scripts to correctly restore those permissions before building the RPM, DEB, and PKG packages, but not before packaging the tarball. Per the bug, it's been sadly broken for two years. You'd download the tarball, try to run ./pwsh and it wouldn't be executable. Now it is, with a regression test that checks the actual file in the tarball before we upload it.

PR Checklist

• PR has a meaningful title
  • Use the present tense and imperative mood when describing your changes
• Summarized changes
• Make sure all .h, .cpp, .cs, .ps1 and .psm1 files have the correct copyright header
• This PR is ready to merge. If this PR is a work in progress, please open this as a Draft Pull Request and mark it as Ready to Review when it is ready to merge.
• Breaking changes
  • None
  • OR
  • Experimental feature(s) needed
    • Experimental feature name(s):
• User-facing changes
  • Not Applicable
  • OR
  • Documentation needed
    • Issue filed:
• Testing - New and feature
  • N/A or can only be tested interactively
  • OR
  • Make sure you've added a new test if existing tests do not effectively test the code changed

[andyleejordan]

*nix permissions in tarball are fixed:

> ls
powershell-7.9.99-preview.22-linux-x64.tar.gz
@andys-macbook-air ~/Downloads 
> $pkgPath = '*.tar.gz'                                                                        
@andys-macbook-air ~/Downloads 
> $entry = & tar -tzvf $pkgPath | Where-Object { $_ -match '\spwsh$' } | Select-Object -First 1
@andys-macbook-air ~/Downloads 
> $entry                                                                                       
-rwxr-xr-x  0 root   root    94672 Apr 27 11:03 pwsh

and

@Andys-MacBook-Air ~/Downloads
% ls
powershell-7.9.99-preview.23-osx-arm64.tar.gz
@Andys-MacBook-Air ~/Downloads
% tar xf ./powershell-7.9.99-preview.23-osx-arm64.tar.gz 
@Andys-MacBook-Air ~/Downloads
% ./pwsh 
PowerShell 7.9.99-preview.22
@andys-macbook-air ~/Downloads 
> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.9.99-preview.22
PSEdition                      Core
GitCommitId                    7.9.99-preview.22
OS                             macOS 26.4.1
Platform                       Unix
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.4
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

no feedback

[Copilot]

Pull request overview

Updates packaging and pipeline signing to (1) restore executable permissions in *nix tarballs and (2) switch signing configuration to use logical certificate/profile variables sourced from the certificate_logical_to_actual variable group.

Changes:

• Ensure pwsh (and createdump) have executable permissions when building tarball/Unix packages.
• Add pipeline regression checks to validate pwsh is executable inside produced .tar.gz artifacts before uploading.
• Replace hardcoded signing certificate/profile identifiers with variables from certificate_logical_to_actual across pipeline templates.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/packaging/packaging.psm1	Restores executable permissions for pwsh and createdump in tarball and Unix package flows.
.pipelines/templates/windows-hosted-build.yml	Uses $(nuget_cert_id) instead of a hardcoded NuGet signing cert ID.
.pipelines/templates/stages/PowerShell-Packages-Stages.yml	Removes Mariner-specific signingProfile parameters (selection moved into the linux packaging template).
.pipelines/templates/shouldSign.yml	Switches Authenticode/MSIX cert selection to mapped variables.
.pipelines/templates/nupkg.yml	Adds certificate_logical_to_actual group and uses $(nuget_cert_id) for NuPkg signing.
.pipelines/templates/mac.yml	Uses $(apple_cert_id) for Apple signing KeyCode.
.pipelines/templates/mac-package-build.yml	Adds cert mapping group usage and validates pwsh executable bit in produced tarballs before upload; uses $(apple_cert_id) for signing/notarization.
.pipelines/templates/linux-package-build.yml	Adds cert mapping group usage, selects PGP signing profile based on Mariner vs non-Mariner jobs, and validates pwsh executable bit for tarballs.