[codex] Keep guard Linux-only

[PerishCode]

Why

Windows remains the slowest required guard path even after trimming it to tests only. The PR merge gate should prioritize fast Linux quality checks, while full platform coverage belongs in release validation.

What

• Reduce guard.yml to a single Ubuntu job that keeps fmt, clippy, workspace tests, and flavor self-check.
• Keep the required check context as guard (ubuntu-latest).
• Extend beta and stable release smoke matrices to include macOS alongside Ubuntu and Windows.

Compatibility

Repository rulesets must require only guard (ubuntu-latest) after this change. Keeping the old Windows/macOS guard contexts required would block future PRs because guard no longer emits them.

Tests

• ruby -e 'require "yaml"; %w[.github/workflows/guard.yml .github/workflows/release-beta.yml .github/workflows/release-stable.yml].each { |p| YAML.load_file(p) }; puts "yaml ok"'
• cargo fmt --all --check
• pre-commit hook during commit: cargo fmt, cargo check, flavor self-check, shell syntax, python syntax; PowerShell syntax skipped because pwsh is not installed