fix: spawn Apple /bin/chmod by absolute path when hardening credentials

The macOS credential hardener strips ACLs with `chmod -N`, spawning
`chmod` by bare name. On machines where Nix home-manager or Homebrew
coreutils sit ahead of /bin on PATH, that resolves to GNU chmod, which
has no `-N` flag and exits non-zero. The hardener treated that as a
failure and refused every save from the Provider Settings panel with
"could not restrict the credential file to your account; nothing was
saved".

Spawn /bin/chmod by absolute path instead, matching how the Windows
branch already resolves its native tools without consulting PATH, and
add a regression test that pins the absolute path.

server/standalone/key-setup-hardening.mjs

@@ -123,7 +123,11 @@ export function hardenCredentialFile(
   if (platform !== 'win32') {
     try {
       if (platform === 'darwin') {
-        const aclRemoval = spawn('chmod', ['-N', filepath], {
+        // `-N` (strip the ACL) is Apple-only. Spawn /bin/chmod by absolute
+        // path, never by name: a Nix/Homebrew coreutils profile puts GNU chmod
+        // first on PATH, and GNU chmod rejects `-N` — which read as a
+        // hardening failure and refused every save on such machines.
+        const aclRemoval = spawn('/bin/chmod', ['-N', filepath], {
           stdio: 'ignore',
         });
         if (!commandCompletedSuccessfully(aclRemoval)) return false;