macos dist

[rksm]

Summary

This sets up the simulator to ship prebuilt macOS binaries for colleagues without requiring a local Rust toolchain.

Changes in this PR:

• add cargo-dist bootstrap/config for macOS release artifacts
• add thin just wrappers for local dist workflows
• generate and check in a dist-managed GitHub release workflow
• route macOS release jobs to blacksmith-12vcpu-macos-latest
• extend local Chrome discovery on macOS to fall back to common app-bundle paths like /Applications/Google Chrome.app/...
• add focused tests for the Chrome binary resolution logic
• record the implementation/validation plan in 2026-04-17_build-macos-binary.md

Validation

Validated locally:

• NIXPKGS_ALLOW_UNFREE=1 nix develop --impure -c just dist-plan --allow-dirty --output-format=json
• NIXPKGS_ALLOW_UNFREE=1 nix develop --impure -c just dist-build --artifacts=local --target aarch64-apple-darwin --output-format=json --allow-dirty
• NIXPKGS_ALLOW_UNFREE=1 nix develop --impure -c cargo test -p client-simulator-browser participant::local::session::tests -- --nocapture
• verified target/distrib/client-simulator-aarch64-apple-darwin.tar.xz contains the client-simulator binary
• verified the built aarch64 binary starts with a stripped PATH and that /Applications/Google Chrome.app/Contents/MacOS/Google Chrome is discoverable outside the Nix shell
• verified dist planning resolves both macOS targets to blacksmith-12vcpu-macos-latest

Notes

Remaining caveats from local validation:

• local dual-target dist builds still fail for x86_64-apple-darwin in the current dev shell because that Rust target stdlib is not installed locally
• the locally built Nix artifact is not a clean portability proof for non-Nix machines; the real release artifact still needs final confidence from a GitHub Actions/tagged build
• I did not run a tag/prerelease Actions dry run in this PR