Support explicit development-QA validation for macOS FSKit artifacts

Outcome

Permit an exact-current macOS FSKit artifact to be rehearsed with an explicitly selected development QA identity without weakening production validation.

Acceptance criteria

• Unset/default production validation remains fail-closed and continues to require stapler and Gatekeeper success.
• Only the exact development-qa mode may bypass stapler and Gatekeeper.
• Development QA still requires strict codesign verification, TeamIdentifier 9BDSL5BJAP, exact app/extension/provider identifiers, matching public versions, the FSKit entitlement, and an executable co-staged provider whose signed bytes and status protocol validate.
• Missing provider or any unknown mode fails.
• Manager output never describes a development-QA artifact as notarized.
• Release workflows remain unchanged.
• Tests prove both retained checks and the narrow bypass.