Verify Apple codesign immediately after ESRP signing by andyleejordan · Pull Request #27486 · PowerShell/PowerShell

The Sign_macOS_* jobs run on a Windows pool, so we cannot call
`codesign`. Scan each Mach-O for the certificate-subject string
`Developer ID Application: Microsoft Corporation` that ESRP embeds
into the CMS signature blob; if it is absent, ESRP did not actually
sign the file and we fail the job. This catches silent ESRP no-ops
(statusCode=pass with byte-identical output) in the job that owns
the signing rather than one stage later in packaging.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>