[chrisnojima]

Not yet tested on a build machine. The full release path below can't be exercised locally. Hold this PR until a macOS test build passes.

What

Moves the logic the packaging scripts copy between each other into packaging/lib.sh. Stacked on #29760.

lib.sh	Replaces
KB_CODESIGN_IDENTITY	The Developer ID hash hard-coded in build_keybase.sh, build_kbfs.sh, build_updater.sh, package_darwin.sh, osx/Scripts/build.sh and go/updater/osx/build.sh
kb_sign_binary <path>...	The darwin/linux/windows signing block copied in the three prerelease/build_*.sh scripts. It runs the same codesign flags for each path.
kb_release_bin	Separate go install …/go/release calls in build_app.sh, package_darwin.sh, s3_index.sh, report.sh, linux/build_and_push_packages.sh and gobuild.sh. It builds the tool once and exports KB_RELEASE_BIN, so the scripts it launches reuse it.
kb_build_id	The date -u +%Y%m%d%H%M%S plus short commit hash computed in version.sh, build_app.sh, build_keybase.sh, build_kbfs.sh and gobuild.sh
kb_lib_version	The separate parsers of go/libkb/version.go. windows/dorelease.cmd keeps its own and points here.

More on kb_release_bin:

• It builds from go/; go/buildtools is the same module.
• Reuse is keyed on GOPATH and the checkout's commit, so a value inherited from another build is rebuilt.
• It installs with GOBIN pinned to $GOPATH/bin.

Other changes:

• build_app.sh builds the release tool after the CLIENT_COMMIT checkout. package_darwin.sh, s3_index.sh and report.sh already rebuilt it at that commit, so they now just reuse it.
• build_app.sh points the helpers at its CLIENT_DIR checkout, and uses one platform variable instead of mixing $PLATFORM and $platform.
• ios/build_and_publish.sh finds the checkout from its own location, the way the Android script does.
• packaging/slack/send.sh keeps its name. build_app.sh keeps running the build machine's master copy after it checks out CLIENT_COMMIT, so every path it calls must exist in both trees. A comment at the checkout and packaging/README.md say so.
• /usr/libexec/plistBuddy is now /usr/libexec/PlistBuddy everywhere.
• packaging/README.md lists the helpers.

Tested locally

• kb_lib_version matches version.go, and kb_build_id matches the old formula. It falls back to SOURCE_COMMIT outside git and works in a git worktree.
• version.sh production and version.sh prerelease print the same values as before.
• With a stub codesign, kb_sign_binary runs exactly the old command line for each binary.
• kb_release_bin:
  • builds the tool;
  • a second call reuses it, with the same mtime;
  • a script it launches reuses it;
  • a stale inherited key forces a rebuild;
  • GOBIN set elsewhere still installs into $GOPATH/bin.
• bash -n passes on every touched script, and the shellcheck job checks the rest.

The test build must confirm

• NOWAIT=1 NOS3=1 TEST=1 PLATFORM=darwin ./build_app.sh completes for amd64 and arm64.
• The log shows "Loading release tool" once per build_app.sh run.
• keybase version -S, kbfs -version, KEYBASE_VERSION and the dmg/zip names all carry the same build id.
• The codesign verify and spctl --assess checks in package_darwin.sh pass, and so does notarization when it isn't skipped.
• The chat posts arrive through slack/send.sh.
• On a run with S3 on, s3_index.sh and report.sh don't rebuild the release tool.
• On a mobile build, iOS finds its checkout without $GOPATH/src, and gobuild.sh works with CHECK_CI both on and off.