Verify macOS Mach-O architecture and deployment targets

[Infiland]

Child scope of #736.

Problem

The macOS release process verifies bundle metadata but does not inspect the complete native graph. The current arm64 bundle contains 124 Mach-O files and native deployment targets as high as macOS 15.0, while the bundle does not declare LSMinimumSystemVersion. A wrong, mixed, empty, malformed, or over-new native graph can therefore be published without a fail-closed architecture/minimum-version gate.

Scope

• Add one stdlib-only verifier for a source .app, the app inside a ZIP, and the app mounted read-only from a DMG.
• Parse Mach-O/fat headers and load commands without trusting filename extensions or file output.
• Require a non-empty inventory containing the main executable, one exact promised thin architecture (arm64 or x86_64) in every Mach-O, matching relative inventories across all three package forms, and no malformed, unknown, mixed, or universal members for architecture-specific artifacts.
• Compute the maximum native minimum-macOS deployment target and require bundle metadata to declare an equal-or-higher LSMinimumSystemVersion.
• Set the reviewed bundle minimum to macOS 15.0 and extend metadata verification accordingly.
• Gate the current arm64 upload with the verifier and keep its command parameterized so Build and smoke-test native arm64 and x86_64 macOS apps #856 can reuse it unchanged for the Intel lane.

Acceptance criteria

• Thin arm64 and x86_64 fixtures pass only for their matching expectation.
• Wrong, mixed, universal, truncated, unknown-CPU, zero-Mach-O, missing-main-executable, unsafe-archive, and app/ZIP/DMG inventory-drift cases fail closed.
• Source app, ZIP, and read-only mounted DMG must agree on every Mach-O relative path, architecture, and deployment target.
• LSMinimumSystemVersion is exactly the reviewed macOS 15.0 baseline and cannot understate any bundled native member.
• The current arm64 release lane runs the parameterized verifier before artifact upload; Build and smoke-test native arm64 and x86_64 macOS apps #856 will add the second invocation without changing verifier semantics.
• Pyright, Ruff, focused verifier/metadata/workflow tests, and the full unit suite pass.

Non-goals

Do not add Intel dependency locks, create the second build lane, publish renamed release assets, or add Developer ID signing/notarization here.