[darkclad]

Summary

GitHub retired the macos-14 runner image. Since 2026-11-06, every nyxus job on that label has been cancelled within seconds, before its first step.

This PR makes two changes to get those jobs running again:

1. Move the jobs to macos-15.
2. Build the macOS prereqs without OpenSSL, because the macos-15 arm64 image's OpenSSL 4.1 breaks the prereq build.

Impact of the retirement

• Pull requests and main: Build And Run Test on Mac is cancelled, and the arm64 wheels in Build Wheels cannot build.
• Release 0.12.0: in the publish run, the arm64 prereq job was cancelled and the arm64 wheel jobs were skipped. The only macOS wheels on PyPI for 0.12.0 are macosx_10_15_x86_64.

Changes

Runner label

Workflow	Updated to macos-15
build_and_test_mac.yml	runner for both test jobs
build_wheels.yml	runner, job names, prereq cache key, artifact names
publish_pypi.yml	runner, job names, artifact names

macos-15 is an arm64 image on GitHub's list of replacements. It is pinned rather than macos-latest to match the other runner labels in these workflows and to keep the Xcode version from changing with the label.

The wheels still target macOS 11.0, so their platform tag does not change.

OpenSSL in the macOS prereqs

The macos-15 arm64 image has Homebrew's OpenSSL 4.1 on its default search path. DCMTK 3.6.9 and the Thrift 0.20.0 bundled with Arrow both pick it up, and neither compiles against it. ci-utils/install_prereq_linux.sh now turns OpenSSL off in both builds on macOS:

Build	Change
DCMTK	-DDCMTK_WITH_OPENSSL=OFF
Thrift	-DWITH_OPENSSL=OFF, added to the Thrift arguments in Arrow's CMake file, because Arrow has no option for it

Nyxus does not reference DCMTK's dcmsign or dcmtls modules, and Parquet does not use Thrift's TLS socket. The change also applies to the Intel prereqs, so they keep building when that image moves to OpenSSL 4.

Testing

This PR's own CI is the first full run on macos-15. Merging needs a check of each macOS job, because the wheel jobs are continue-on-error and a failed one does not fail the workflow run.

Changing the install script changes the prereq cache key, so this PR rebuilds the prereqs on every platform. delocate-wheel still fails the wheel build if a bundled library requires a macOS version newer than 11.0.

publish_pypi.yml does not run on pull requests, so its first run on macos-15 will be the next release.

After merging

• The fix(ci) title should make release-please propose a patch release, which would bring the arm64 wheels back to PyPI. Republishing from the v0.12.0 tag cannot do this, because that tag's workflow still uses macos-14.
• Open PRs need a new push to pick up this change and get their Mac and arm64 wheel jobs running again.