[codex] Fix Developer ID DNS proxy signing

[offyotto]

Summary

• add Direct-only entitlements using dns-proxy-systemextension for Developer ID / Direct distribution profiles
• add a shared LocaleAppDirect scheme and Direct build configuration that archives unsigned so export/signing can apply Direct profiles cleanly
• add a repeatable script/export_developer_id.sh flow that embeds Direct provisioning profiles, re-signs the app and DNS proxy extension, and verifies the final app
• document when to use LocaleApp / App Store Connect vs LocaleAppDirect / Developer ID

Root Cause

Xcode's Store/TestFlight profiles for Locale include com.apple.developer.networking.networkextension = dns-proxy, while the Direct/Developer ID profiles include dns-proxy-systemextension. The previous single entitlement file made Developer ID export try to apply Direct profiles to Store entitlement values, producing the provisioning profile mismatch.

Validation

• plutil -lint Resources/ExportOptions-DeveloperID.plist Resources/LocaleDirect.entitlements Resources/LocaleDNSProxyDirect.entitlements
• bash -n script/export_developer_id.sh script/package_notarized.sh
• swift test
• xcodebuild -quiet -project Locale.xcodeproj -scheme LocaleApp -configuration Release -destination 'generic/platform=macOS' -archivePath /tmp/LocaleReleaseProfileFixBranch.xcarchive -allowProvisioningUpdates archive
• ./script/export_developer_id.sh
• verified final Developer ID app and DNS proxy entitlements both contain dns-proxy-systemextension

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.