iOS TestFlight: re-export .p12 as legacy PKCS12 before security import

macOS Keychain Access on Sonoma+ exports .p12 with modern crypto
(AES-256-GCM + PBKDF2 + SHA-256). The `security import` binary on
some macOS releases — including ours apparently — rejects it with:
  SecKeychainItemImport: Unknown format in import.

The openssl decode itself was fine (now using openssl base64 -d -A),
but security can't import the resulting PKCS12 envelope.

Pipe the .p12 through openssl: unpack with the user's password, then
re-export using legacy PBE-SHA1-3DES for both certs and keys, plus
SHA1 MAC. The resulting .p12 uses 90s-era crypto for the OUTER
envelope, which is what security import wants — the actual signing
keys + cert inside are unchanged. No security implication; the legacy
format encryption only matters for the few seconds the .p12 lives in
$RUNNER_TEMP before being imported and deleted.

Also added diagnostic output (file size, magic bytes, file(1)) so the
next failure mode (if any) is easier to characterize.

.github/workflows/build-ios-testflight.yml

@@ -256,15 +256,36 @@ jobs:
           security unlock-keychain -p "$APPLE_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
           # Add to user search list so codesign can find it
           security list-keychains -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | sed 's/"//g')
-          # Import the .p12
-          P12="$RUNNER_TEMP/dist.p12"
-          echo "$APPLE_DIST_CERT_P12_BASE64" | openssl base64 -d -A > "$P12"
+          # Decode the user-uploaded .p12 to disk.
+          P12_MODERN="$RUNNER_TEMP/dist-modern.p12"
+          echo "$APPLE_DIST_CERT_P12_BASE64" | openssl base64 -d -A > "$P12_MODERN"
+          echo "=== uploaded .p12 file ==="
+          ls -la "$P12_MODERN"
+          xxd "$P12_MODERN" | head -1
+          file "$P12_MODERN" || true
+
+          # macOS Keychain Access in Sonoma+ exports .p12 with modern crypto
+          # (AES-256-GCM + PBKDF2 + SHA-256) that the `security import`
+          # binary on some macOS releases rejects with
+          # "SecKeychainItemImport: Unknown format in import." Re-export
+          # the PKCS12 through openssl using legacy PBE-SHA1-3DES so the
+          # macOS security command can definitely parse it.
+          P12="$RUNNER_TEMP/dist-legacy.p12"
+          echo "=== converting to legacy PKCS12 format ==="
+          openssl pkcs12 -in "$P12_MODERN" -nodes \
+              -password pass:"$APPLE_DIST_CERT_P12_PASSWORD" \
+            | openssl pkcs12 -export \
+              -macalg sha1 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES \
+              -password pass:"$APPLE_DIST_CERT_P12_PASSWORD" \
+              -out "$P12"
+          ls -la "$P12"
+
           security import "$P12" -k "$KEYCHAIN_PATH" -P "$APPLE_DIST_CERT_P12_PASSWORD" \
             -T /usr/bin/codesign -T /usr/bin/security
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$APPLE_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
           # Sanity-check: list identities the keychain offers
           security find-identity -v -p codesigning "$KEYCHAIN_PATH"
-          rm -f "$P12"
+          rm -f "$P12_MODERN" "$P12"
 
       - name: Install provisioning profile + parse name/UUID for ExportOptions
         env: