fix: restore release keychain probe contract

[rianjs]

Summary

• update the packaged darwin keychain probe to the current durable config schema
• pin the probe command to config show --profile default --json
• add a manifest/config contract test that checks every packaged probe assertion against runtime output

Testing

• go test ./internal/cmd/configcmd ./internal/config
• go build ./cmd/cr
• local darwin-gate.sh probe run against the built binary using exported keychain_probe

Fixes #387.