Release: drop an empty CSC_LINK so the keychain identity signs the macOS build

electron-builder read the empty secret as a certificate path and failed with "not a file". Also keeps lighting.ts types module-private.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/release-build.yml

@@ -112,6 +112,8 @@ jobs:
           APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
           APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
         run: |
+          # An empty CSC_LINK reads as a certificate path; the keychain signs instead.
+          [ -n "$CSC_LINK" ] || unset CSC_LINK CSC_KEY_PASSWORD
           printf '%s' "$APPLE_API_KEY_P8" > "$APPLE_API_KEY"
           trap 'rm -f "$APPLE_API_KEY"' EXIT
           pnpm build

src/renderer/src/pages/office/lighting.ts

@@ -4,7 +4,7 @@ import type { DayPart } from "../../shared/palette-clock";
 import { BACK_WALL_H, toIso, type IsoFrame } from "./iso";
 import { WALL } from "./floor-plan";
 
-export interface Light {
+interface Light {
   at: Vec;
   z: number;
   /** Reach in iso pixels. */
@@ -66,7 +66,7 @@ export function ditherLevels(data: Uint8ClampedArray, width: number): void {
   }
 }
 
-export interface LightingInput {
+interface LightingInput {
   frame: IsoFrame;
   camera: Camera;
   /** Scene pixels per iso pixel. */