ci(bootstrap): add macOS verification

[xinyiklin]

Summary

Add macos-latest to bootstrap CI so every pull request and main push runs the disposable regression suite on Linux, Windows, and macOS. Local execution on the developer's Mac is no longer treated as a substitute for repeatable macOS CI evidence.

Scope

• Important files, packages, or consumers: .github/workflows/bootstrap.yml, the CI contract in scripts/test-bootstrap.mjs, and repository verification guidance
• Related product / engineering / continuity docs: README.md and CONTINUITY.md
• Breaking change, migration, or rollout note: None

Verification

• Focused checks: red/green regression confirmed; the new test failed on the missing macos-latest runner, then passed after the matrix update
• Broader consumer checks: node scripts/test-bootstrap.mjs passed every branch-owned check, including Python tomllib parsing of 2 adversarial fixtures; the command remains nonzero only for the pre-existing machine-local Impeccable content drift (actual 1a05c01…, reviewed manifest c882be32…)
• node scripts/init-workspace.mjs --check --skip-skills: passed
• node --check scripts/test-bootstrap.mjs: passed
• git diff --check: passed
• Self-review: complete staged diff reviewed for the four intended files
• Independent review: no actionable findings; workflow, test, README, and continuity contract are consistent
• Visual / live / deployment checks skipped or unverified, with reason: not applicable to a CI matrix and documentation-only behavior change
• GitHub runner evidence: Actions run 31914815740 passed on Ubuntu, Windows, and macOS at exact head 23045823bf3178e1aeb97672400f2e6f7c5488a3

Risk and follow-up

• Known risks or residual uncertainty: no known branch-owned CI failure; the added macOS job increases workflow runner usage
• Follow-up work: reconcile the unrelated machine-local Impeccable hash drift separately; do not change its reviewed pin in this PR

Publication

• Base branch: main
• Merge strategy: squash
• Release / deploy impact: None