Splitting the macOS Code Signing Handover Between the Product Team and the IT/SRE Team — Separating Account Holder Work from GitHub Environment Secret Registration

Issuing a Developer ID Application certificate requires the Account Holder role, and registering GitHub Environment secrets requires repo Admin, so neither an IT/SRE team nor a product team can finish the handover alone. This post groups the handoff values into four classes with matching confidentiality, compares IT/SRE registering the secrets directly (Path A) with a 1Password shared vault handoff (Path B), scopes certificates and API keys by organizational boundary, and shares a ledger across both teams.