CI macOS: hardened-runtime checks read codesign's output from a file

The viewer-bundle and rugnux-tarball checks piped `codesign -d` into `grep -q`. grep exits at the
first match, codesign then dies of SIGPIPE (141), and under `set -o pipefail` that is the pipeline's
status, so a correctly signed bundle was reported as "no hardened runtime". Both checks now write to a
file and grep it, as the other checks in this workflow do, and print the signature when they fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build_and_test.yml

@@ -294,7 +294,9 @@ jobs:
           # rugnux is in an archive of its own, not in the app
           find "$app" -name rugnux > /tmp/jfjv.extra
           if [ -s /tmp/jfjv.extra ]; then cat /tmp/jfjv.extra; echo "the bundle carries another program"; exit 1; fi
-          codesign -d --verbose=2 "$app" 2>&1 | grep -q "flags=.*runtime" || { echo "no hardened runtime"; exit 1; }
+          # to a file, not piped into `grep -q` (see "Verify rugnux is self-contained" above)
+          codesign -d --verbose=2 "$app" > /tmp/jfjv.sig 2>&1
+          if ! grep -q "flags=.*runtime" /tmp/jfjv.sig; then cat /tmp/jfjv.sig; echo "no hardened runtime"; exit 1; fi
           echo "self-contained and validly signed"
       - name: Verify rugnux is self-contained
         shell: bash
@@ -311,7 +313,8 @@ jobs:
           if ! grep -qi "usage" /tmp/rgxm.out; then cat /tmp/rgxm.out; echo "rugnux did not start"; exit 1; fi
           # and carries the Developer ID signature with the hardened runtime that notarization demands
           codesign --verify --strict "$bin"
-          codesign -d --verbose=2 "$bin" 2>&1 | grep -q "flags=.*runtime" || { echo "no hardened runtime"; exit 1; }
+          codesign -d --verbose=2 "$bin" > /tmp/rgxm.sig 2>&1
+          if ! grep -q "flags=.*runtime" /tmp/rgxm.sig; then cat /tmp/rgxm.sig; echo "no hardened runtime"; exit 1; fi
           echo "self-contained, runs and is validly signed"
       # Every push, not only a release: a rejection by Apple (a library macdeployqt left unsigned, an
       # entitlement the hardened runtime needs) should show up when the change is made, not when the