After every keychain write, replace the item's ACL with an explicit
SecAccess whose trusted-application list is this app's code-signature
requirement (SecTrustedApplicationCreateFromPath(NULL)):
- New installs: items are ACL-pinned from the first save, so future
upgrades never prompt (Developer ID requirement is stable).
- Upgraders from ad-hoc builds: the first access shows the standard
one-time prompt; 'Always Allow' now permanently rewrites the ACL
instead of just appending, so stale ad-hoc entries are cleaned up.
- Ref-only item lookup (kSecReturnRef) never prompts, and failures are
swallowed so keychain writes never fail because of ACL work.
adrianbonpin