match

Signing state has exactly one owner, or it has none

Certificates, profiles and keychain state get asserted by one flow or by nobody — and a second writer stays invisible until the next build needs to sign.