[tas0dev]

Initialize application-specific signing credentials entirely on a protected GitHub Actions runner. The generic helper accepts successful default-branch MPKG artifacts, binds their exact source/SDK/package/checksum, and requires the caller-selected Team and branch protections. It never builds or executes application code, enables publication, or releases a package.

Persist an encrypted keypair recovery Secret before certificate issuance so retries reuse the same key. Kome device login validates the selected Developer and obtains its exact-package certificate; a local signing/verification check precedes one atomic MSIGN_IDENTITY_B64 Secret write. Credentials never become downloadable artifacts. The setup PAT is restricted to Environment writes and never reaches Kome/msign; the temporary login is logged out and files removed. Successful setup deletes recovery/setup Secrets. Existing production identities and enabled publication are refused.

Add locked standalone Kome host-tool builds and support for signing an existing CI-produced MPKG without Kome project compilation/repackaging. Maintain compatibility with legacy three-value signing configurations, rejecting mixed configurations.

Validation: 20 Python tests pass locally, covering failed issuance recovery, same-key retries, existing identity protection, wrong branch/fork/PR rejection, atomic identity handling and credential transport. Actions also runs the real Kome and msign builds/tests without production credentials. Actual certificate issuance remains behind the application's main-branch Environment approval; no local certificate request is performed.

Final verification: https://github.com/mochiOS/devkit/actions/runs/42987419911 succeeded (20 Python tests, 28 msign tests, 52 Kome tests and both release tool builds). The pinned Edit caller also passed: https://github.com/mochiOS/Edit.app/actions/runs/42988089358 .