Add macOS Touch ID gates and biometric secret storage

[nvk]

Summary

Add macOS user-authentication support around secret injection with two complementary paths:

• touchid-check, a standalone Swift helper for shell-level user authentication on unsigned/Homebrew-style installs
• envchain --set -b, which stores items with kSecAccessControlUserPresence for properly signed builds

What changed

• build and install touchid-check on macOS when swiftc is available
• add biometric save support with entitlement preflight, actionable errors, and restore-on-failure semantics
• add a Linux stub for --set -b
• document the signed-build path and the shell-helper path in TOUCHID.md

Notes

• the helper path is the practical default for unsigned CLI installs
• biometric Keychain ACL storage requires a properly signed envchain binary

Verification

• make -B