feat: add macOS ARM64 release pipeline

[hututuQQQ]

Summary

• add a verified darwin-arm64 Runtime with strict thin Mach-O architecture checks
• add fail-closed Seatbelt sandboxing, forkpty support, network policy enforcement, and macOS doctor reporting
• add native macOS CI plus coordinated Sigma Code desktop packaging/signing validation
• publish a v0.1.6 public prerelease with an exact six-asset allowlist and consolidated evidence, while retaining updater metadata as 90-day Actions artifacts

Validation

• TypeScript build and lint
• 1,534 full-suite tests passed (26 platform skips); isolated eval runner: 32/32
• Rust fmt, tests (104), and clippy
• actionlint for CI and release workflows
• macOS smoke script syntax validation

Coordinated desktop application: hututuQQQ/sigma-code#11