Sign bundle contents serially

Signing the app image's Mach-O files with "xargs -P 8" passed locally but
failed on a runner: codesign reported "replacing existing signature" and then
"No such file or directory" for that same path. The two libjli.dylib copies are
separate inodes, so this is not hard links being signed twice -- concurrent
codesign runs over one bundle are simply not reliable. Serially costs about a
minute, since each call waits on Apple's timestamp server.

Also stop the matrix from cancelling the other architecture on a failure; that
throws away half the diagnostic information from a failed run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WYcmHra3YndA1ahkHeNdJ2

.github/workflows/nightly-artifacts.yml

@@ -609,6 +609,7 @@ jobs:
     name: Build macOS DMG (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
         os: [macos-latest, macos-15-intel]
 

.github/workflows/tagged-release.yml

@@ -506,6 +506,7 @@ jobs:
     name: Build macOS DMG (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
         os: [macos-latest, macos-15-intel]
 

packaging/macos/build-signed-dmg.sh

@@ -142,9 +142,12 @@ done > "$MACHO_LIST"
 COUNT="$(wc -l < "$MACHO_LIST" | tr -d ' ')"
 echo "    $COUNT Mach-O files to sign"
 
-# codesign contacts Apple's timestamp server on every call, so run a handful in
-# parallel or this takes far longer than it needs to.
-xargs -P 8 -I {} codesign --force --timestamp --options runtime \
+# Serially, deliberately. Running codesign concurrently over several files of
+# the same bundle fails intermittently -- a CI run died with "replacing existing
+# signature" immediately followed by "No such file or directory" for that same
+# path, while the identical script passed locally. Each call contacts Apple's
+# timestamp server, so this costs about a minute for a runtime this size.
+xargs -I {} codesign --force --timestamp --options runtime \
     --sign "$FULL_IDENTITY" {} < "$MACHO_LIST"
 rm -f "$MACHO_LIST"