macOS: Add com.apple.trustd to mach-lookup allowlist (Go TLS broken)

## Problem

Go-based CLI tools (e.g. `gh`, `terraform`, `kubectl`) fail with TLS certificate verification errors when running inside the macOS seatbelt sandbox:

```
Get "https://api.github.com/user": tls: failed to verify certificate: x509: OSStatus -26276
```

`OSStatus -26276` = `errSecInternalError` from `SecTrustEvaluateWithError`.

## Affected Tools

Any Go binary doing HTTPS: `gh`, `terraform`, `kubectl`, `helm`, `docker`, `cosign`, etc.

## Workaround

Currently using a curl-based shim for `gh` CLI calls, but this doesn't scale to other Go tools.