docs: changelog entry for the macOS chmod fix (#694)

Credit the fix in CHANGELOG and tidy the wording of its inline comment.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+- Saving a key from Provider Settings works again on Macs where Nix or
+  Homebrew coreutils sit ahead of `/bin` on `PATH`. The credential hardener
+  now spawns Apple's `/bin/chmod -N` by absolute path; GNU `chmod` has no `-N`,
+  so the ACL strip failed closed and every save was refused (Arthur Bogaart, #694).
+
 - Render on iPad and iPhone instead of stopping with "An error occurred while
   rendering." Cesium's per-vertex model atmosphere binds shader `out`
   parameters directly to varyings, which Apple's Metal/ANGLE backend cannot

server/standalone/key-setup-hardening.mjs

@@ -125,7 +125,7 @@ export function hardenCredentialFile(
       if (platform === 'darwin') {
         // `-N` (strip the ACL) is Apple-only. Spawn /bin/chmod by absolute
         // path, never by name: a Nix/Homebrew coreutils profile puts GNU chmod
-        // first on PATH, and GNU chmod rejects `-N` — which read as a
+        // first on PATH, and GNU chmod rejects `-N` — which was treated as a
         // hardening failure and refused every save on such machines.
         const aclRemoval = spawn('/bin/chmod', ['-N', filepath], {
           stdio: 'ignore',