fix: propagate Mach-O signing failures

[takeokunn]

Summary

• make missing, timed-out, and failed Mach-O codesigning fail the writer
• retain structured success diagnostics
• add failure-injection coverage for the public writer boundary

Verification

• git diff --check passed locally
• targeted test command is blocked locally because ASDF cannot find cl-log-kit; CI must verify the selected failure-injection test

The change is based on the latest origin/main.

[takeokunn]

Independent review findings and resolution:

• The review identified that signing failure could leave an unsigned target behind. Fixed in 0c2a62d by signing a same-directory staged file and atomically replacing the target only after success; failures now signal exported macho-codesign-error.
• The review identified that the original injection test depended on the host /usr/bin/codesign. Replaced it with deterministic injection of both process failure and timeout callbacks, including an assertion that the existing target remains unchanged.
• Updated the API and concepts documentation to describe the propagated failure contract.

CI verification: run 37572516996 passed. The two failure-injection tests were selected and passed; the suite reported 202 passed, 2 skipped, 0 failed, 0 errored, 204 total.