fix(macos): preserve streamed sandbox violations

[linhongyu510]

Summary

• switch the macOS violation monitor from compact log output to NDJSON
• frame stdout with readline so coalesced records, split records, and split UTF-8 code points are handled correctly
• keep command attribution and ignore filtering local to each log record
• make monitor shutdown idempotent and prevent post-stop callbacks

The previous implementation treated each stdout data chunk as a complete log record and selected only its first violation/tag pair. Because stream chunks are arbitrary, one chunk could contain multiple records or part of one record, causing dropped events, missing attribution, and corrupted Unicode paths.

This changes ingestion only; it does not alter Seatbelt profiles or sandbox permissions.

Verification

• Regression suite against origin/main: 8 failed, 1 passed
• Regression suite on this branch: 9 passed
• Stability run: 180 passed across 20 repetitions
• Full suite with CI-pinned Bun 1.3.14: 972 passed, 399 skipped, 0 failed
• npx eslint .
• npm run typecheck
• npm run build
• Prettier check
• Node.js fallback tests

A live macOS probe also confirmed that a denied cat exits with Operation not permitted and the NDJSON monitor reports the matching file-read-data event with the exact command attribution.

[linhongyu510]

The Tests workflow is currently waiting with action_required and has no jobs, consistent with approval being required for a first contribution. The branch is up to date with main; local verification on the CI-pinned Bun 1.3.14 completed with 972 passed, 399 skipped, and 0 failed. Could a maintainer approve the workflow run when convenient?