Move shared keychain migration from renderer to main process

Replace crossAppIPC-based secret handshake with direct shared keychain
writes in the main process:

- MacOSCrossAppSecretSharing now reads safeStorage+SQLite and writes to
  shared keychain via SharedKeychainMainService (no crossAppIPC needed)
- Code.app migrates on startup; Agents app spawns Code.app once if
  keychain is incomplete
- NativeSecretStorageService no longer does migration — just reads/writes
  shared keychain for cross-app keys

src/vs/code/electron-main/app.ts

@@ -1275,12 +1275,12 @@ export class CodeApplication extends Disposable {
 			this._register(new MacOSCrossAppSecretSharing(
 				accessor.get(IStorageMainService),
 				accessor.get(IEncryptionMainService),
+				accessor.get(ISharedKeychainMainService),
 				accessor.get(IStateService),
 				this.logService,
 				this.environmentMainService,
 				accessor.get(ILaunchMainService),
 				this.lifecycleMainService,
-				crossAppIPCService,
 			));
 		}