Allow MenuBarItemService XPC connection on builds without a Team Identifier

[djmango]

Summary

On the macos-26 branch, the new MenuBarItemService enforces an isFromSameTeam requirement on both sides of the XPC link:

• Listener: XPCListener(service: name, requirement: .isFromSameTeam()) (MenuBarItemService/Listener.swift)
• Client: session.setPeerRequirement(.isFromSameTeam()) (Ice/MenuBar/MenuBarItems/MenuBarItemServiceConnection.swift)

Ad-hoc / locally-signed builds have no Team Identifier, so this requirement can never be satisfied. The XPC session is rejected at activation:

[MenuBarItemService.Connection] Session failed with error Error Domain=XPC.XPCRichError Code=1
[MenuBarItemService.Connection] Start request returned nil
[MenuBarItemService.Connection] Source PID request returned nil

Because source PIDs are never resolved on macOS 26 (item windows are owned by Control Center, so the source app is found via the XPC service), the menu bar item list stays empty and the UI is stuck on "Loading menu bar items…" indefinitely. This makes the branch unusable for anyone building locally without a Developer Team.

Changes

• Add Shared/Utilities/CodeSigning.swift, exposing CodeSigning.teamIdentifier / hasTeamIdentifier via SecCodeCopySigningInformation.
• Gate the isFromSameTeam requirement on whether the running process actually has a Team Identifier:
  • Signed builds (with a team): unchanged — the same-team requirement is still enforced.
  • Ad-hoc / local builds (no team): fall back to an unrestricted listener / no peer requirement so the connection succeeds.

No-op for release builds; only relaxes the requirement when there is no team to enforce it against.

Related

This is the same class of issue as #744 / #891, and overlaps with #950 and one commit of #903 (all three independently added a team-identifier guard). Happy to consolidate toward whichever approach you prefer.

Test plan

• Builds on Xcode 26 / Swift 6.3 / macOS 26.5.
• Ad-hoc signed build: XPC session connects, source PIDs resolve, item list populates.
• Developer ID signed build (app + service same team): same-team requirement is still used and satisfied.