fix: harden mac release service account reads

[steipete]

Summary

• remove --account from explicit 1Password service-account reads and force desktop integration off
• deliver the current OP_SERVICE_ACCOUNT_TOKEN to the shared op-work task window through a mode-0600 one-shot file, then delete it
• preserve interactive desktop vault reads with account selection and pane TTY access

Tests

• skills/release-mac-app/scripts/mac-release.test.sh
• bash -n across the release helper scripts
• shellcheck on the changed scripts
• git diff --check
• structured autoreview and secret scan