fix(release): avoid headless Sparkle keychain prompt

[hcaiano]

Summary

• pass the existing temporary Sparkle private-key file directly to sign_update in CI
• keep Keychain-based signing as the default for local releases
• prevent the appcast step from waiting on an unavailable headless Keychain permission prompt

Test plan

• swift build
• swift run cycler-tests (ok — 106 checks passed)
• actionlint .github/workflows/release.yml
• bash -n Scripts/sparkle-appcast.sh
• git diff --check

Runtime evidence

• release run 29109512518 passed credentials, quality gate, notarization, and release upload, then remained blocked only in Regenerate appcast until canceled