release: empty keychain-args array must not trip set -u on macOS bash 3.2

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

scripts/publish-update.sh

@@ -214,7 +214,7 @@ fi
 # above, which is what ships. A no-op when the two happen to be the same.
 echo "==> Signing ${APP_BUNDLE} with resolved identity"
 run_signed codesign --force --options runtime --timestamp \
-    "${CODESIGN_KEYCHAIN_ARGS[@]}" \
+    ${CODESIGN_KEYCHAIN_ARGS[@]+"${CODESIGN_KEYCHAIN_ARGS[@]}"} \
     --sign "${SIGN_IDENTITY}" \
     --identifier "${BUNDLE_ID}" \
     "${APP_BUNDLE}"