Mirror the abe_embed treatment of the Windows ABE payload (#575) for the
macOS CVE-2025-24204 securityd-dump path: retag gcoredump_darwin.go under
'darwin && keychain_gcore' and add a 'darwin && !keychain_gcore' stub for
DecryptKeychainRecords. The default go build (and library consumers) then
ship without the exploit code or its byte signatures; the capability is
opt-in via -tags keychain_gcore, exactly like -tags abe_embed.
GcoredumpRetriever already treats a DecryptKeychainRecords error as a silent
fallthrough to the next tier, so the default build falls through to the
native security-CLI path with no behavior change.
* feat(restore): cross-platform restore via dump engine rebuild (#606)
Restore previously required the dump's origin OS, overlaying keys onto locally-discovered browsers. It now rebuilds Chromium engines from the dump's vaults (v2 adds engine kind), so copied data or an archive zip decrypts on any OS.
* fix(restore): polish help text, drop dead check, dedup dump kinds
pflag treats backticked words in flag usage as the value placeholder,
so --data-zip rendered as "--data-zip archive" in help output.
