Harden macOS OrbStack runtime recovery

[jsugg]

Summary

• Verify the OrbStack DMG checksum before mounting it.
• Add bounded OrbStack recovery when macOS Docker readiness fails with socket, timeout, or connectivity errors.
• Capture before/after recovery diagnostics, including OrbStack logs/status, Docker context, socket state, and recovery command output.
• Add structured recovery metadata to the runtime install report.
• Gate OrbStack-specific tests to macOS so Linux machines do not run them.