ci: portability testing on macOS

[adamdaw]

Add a CI workflow that tests scripts on macOS to catch GNU/BSD differences.

Context

The Makefile handles BSD vs GNU sed, but other scripts may have subtle portability issues (grep -P is GNU-only, etc.). A macOS CI run would catch these early.

Acceptance Criteria

• New workflow or job running on macos-latest
• Runs ShellCheck, bats tests, and make validate
• Documents any macOS-specific limitations

Reference: docs/pipeline-decisions.md (portability section)