[Bug] macOS Keychain repeated and frequent prompts to allow access

macOS Keychain prompts constantly for `copilot-mcp-oauth` — a new keychain item is created on every token refresh, and "Always Allow" never persists.

**Affected version:** v1.0.25

## Summary
On macOS, the GitHub app repeatedly triggers a system Keychain password prompt for the keychain service `copilot-mcp-oauth`. Clicking **Always Allow** does not stop it — I'm asked for my macOS login password many times a day to unlock Keychain for the GitHub App.

## Environment
- GitHub app version: 1.0.25 (latest installed)
- OS: macOS 26.5.2 Tahoe
- Keychain service affected: `copilot-mcp-oauth`
- Related MCP integration: Power BI (token scope `https://analysis.windows.net/powerbi/api/user_impersonation`)

## What I observed
- The `copilot-mcp-oauth` keychain contains a large number of separate entries — **63 for today alone**.
- Each entry stores a short-lived OAuth token, e.g.:
`{"accessToken":"","expiresAt":1784716427,"scope":"/powerbi/api/user_impersonation"}`
- A new entry appears to be created on **every token refresh** rather than updating a single existing entry.

## Actual behavior
A new keychain item is created on each refresh. Because macOS "Always Allow" trust is granted **per item**, it never applies to the newly created items — producing constant password prompts and dozens of stale entries per day.

## Possible cause (two mechanisms likely compounding)
1. **Per-refresh item creation** — the token cache writes a new keychain item instead of overwriting one, so previously granted access never applies.
2. **Unstable ACL / code-signing identity** — if the accessing helper process isn't stably code-signed, macOS treats each access as a new requester and re-prompts even for an existing item. This is the classic reason "Always Allow" fails to persist.

## Impact
Password fatigue plus dozens of stale OAuth entries accumulating in the login keychain every day. Disruptive to normal workflow.

## Steps to reproduce
1. Use the GitHub app on macOS with the Power BI MCP integration authenticated.
2. Continue normal use so the OAuth access token refreshes (tokens are short-lived).
3. Observe a macOS Keychain access prompt for `copilot-mcp-oauth`.
4. Click **Always Allow**.
5. On the next token refresh, the prompt reappears.
6. Open **Keychain Access** and search `copilot-mcp-oauth` — note the growing count of distinct entries.

## Expected behavior
Tokens for a given MCP integration are stored in (and updated within) a **single** keychain item, so granting **Always Allow** once persists and no further prompts appear.

跟踪 `copilot-mcp-oauth` 的 macOS Keychain 访问路径，从 token-cache 刷新/写入逻辑和 MCP OAuth 集成开始。验证刷新是否会创建不同的条目，并检查 helper 的签名身份和 ACL 行为。完成标准是每个集成只有一个条目被原地更新，并且“Always Allow”能够持久生效而不会反复提示；如果存在相关测试，则补充回归覆盖。

由索引模型根据 Issue 内容生成。