fix(codegen,ci): keep stale Apple cross runtimes from breaking iOS/tvOS links (#4856)

[proggeramlug]

Fixes #4856 — iOS/tvOS executable links at 0.5.1150 failed with undefined symbol: _perry_macos_bundle_chdir because the release pipeline shipped stale Apple cross runtime archives: Swatinem/rust-cache restored a target/ whose fingerprints let cargo skip rebuilding perry-runtime after #4833 added the symbol.

Implements all three fixes suggested in the issue:

1. Codegen: gate the perry_macos_bundle_chdir emission to macOS targets

entry.rs now emits the call in main's prelude only when the target triple is *-apple-macosx* / *-apple-darwin* (new is_macos_triple helper). The runtime fn is a documented no-op everywhere else, so behavior is unchanged — but iOS/tvOS/visionOS/watchOS/Linux/Android/Windows executables no longer reference a macOS-only symbol, which unblocks Apple-mobile links even against an already-stale runtime. New IR regression test (macos_bundle_chdir_gate.rs) asserts emit-on-macOS / omit-on-10-other-triples.

2. Release CI: bust the workspace portion of the restored cache

Both build: and build-cross: now delete the workspace crates' .fingerprint entries (host and target/<triple>/ layouts) right after the rust-cache restore, forcing perry-runtime/stdlib/UI/CLI to rebuild from the checkout every release while keeping the expensive external-dependency precompiles cached. Note cargo clean -p is not sufficient — verified locally that it only covers the host layout and never touches target/<triple>/ dirs.

3. Release CI: post-build symbol guard (defense in depth)

New scripts/check_runtime_symbols.sh asserts each built runtime archive defines sentinel #[no_mangle] symbols (js_gc_init, perry_macos_bundle_chdir). It reads the archive symbol index (nm --print-armap) with exact-token matching, so it works on Mach-O/ELF/COFF and — unlike a plain nm listing — on the thin-LTO bitcode members that Apple's nm can't parse (verified locally: Xcode's nm errors with Unknown attribute kind on the rustc-emitted bitcode, but the armap is plain data). Wired into both build: (verifies host + all cross archives the leg built) and build-cross: (per-triple). A stale archive now fails the release job instead of shipping.

Validation

• cargo test --release -p perry-codegen — all 13 suites green, including the 2 new gate tests
• cargo fmt --check, file-size gate, actionlint — no new findings vs base
• Symbol guard tested positive (current libperry_runtime.a passes) and negative (synthetic archive without the sentinels fails with ::error::), including the system-nm-only fallback path used on CI macs
• Hello-world compile + run on macOS host confirms the chdir call is still emitted and resolved there

Per maintainer convention, no version bump / changelog in this PR — folded in at merge time.