apple: prefer implicit default keychain; explicit path as fallback

[jgowdy-godaddy]

Summary

Follow-up to #68 and #69. Root-causes the npmenc macOS CI hang and restores pre-#68 CI behaviour while keeping the `$HOME`-override dialog fix.

• Threat-model hardening pass: envelope, meta HMAC, bridge, process, adapter #68 made the Swift bridge unconditionally open the login keychain by absolute path and pin every `SecItem*` op to it via `kSecUseKeychain` / `kSecMatchSearchList`. That fixed a "Keychain Not Found" modal on local dev tests that override `$HOME`.
• But pinning ops to the legacy login keychain made headless CI runners hang: `SecItemAdd` then blocks on a same-binary ACL confirmation prompt that the runner can never answer. apple: silent empty-password unlock of login keychain on open #69's empty-password unlock was not sufficient — the hang isn't lock state, it's the ACL dialog.
• New behaviour: check `SecKeychainCopyDefault` first. When a default is reachable (normal interactive sessions and GitHub Actions runners), let Security.framework route implicitly — that reaches the Data Protection keychain on unsigned builds and never fires the legacy ACL dialog. Only when no default is reachable do we fall back to explicit-path open, preserving Threat-model hardening pass: envelope, meta HMAC, bridge, process, adapter #68's dialog-avoidance fix for `$HOME`-override tests and launchd sandboxes.

Test plan

• `cargo clippy -p enclaveapp-apple --features signing,encryption --all-targets -- -D warnings`
• `cargo test -p enclaveapp-apple --features signing,encryption --lib` — 44 pass (including real-keychain `keychain_wrap::tests`)
• `cargo test --test integration -p npmenc -- --test-threads=1` — 30 pass locally in 2.78s
• npmenc Skip co-author trailers in CLAUDE.md #18 macOS CI green after merge (was hanging 30+ min, expected < 2 min)