ci(self-packaging #49): cross-platform pack smoke jobs

[jrosskopf]

Part of epic #40. Stacked on #58 -> #57 -> #56 -> #55 -> #54 -> #53 -> #52 -> #51.

Summary

Adds four new CI jobs exercising the self-packaging surface on every
platform flapi builds for:

Job	Runner	Verifies
pack-smoke-linux-amd64	ubuntu-24.04	pack / info / unpack / reproducibility
pack-smoke-linux-arm64	ubuntu-24.04-arm	same
pack-smoke-macos	macos-latest	pack / info / unpack + otool -l segment check + codesign --verify --strict + --macos-append legacy path + oversized-payload error
pack-smoke-windows	windows-latest (pwsh)	pack / info / unpack / reproducibility

create-release now needs the four new jobs in addition to the
existing build + HTTP smoke matrix, so a broken pack on any platform
blocks the release.

Verifications per job

Common across all four:

# Pack the fixture
flapi pack --in fixture --out out-a

# `info` lists the fixture entries
flapi info | grep -q "flapi.yaml"
flapi info | grep -q "sqls/hello.sql"

# `unpack` restores byte-for-byte
flapi unpack --to extracted
diff fixture/sqls/hello.sql extracted/sqls/hello.sql

# Reproducibility (Linux + Windows only -- see note below)
SOURCE_DATE_EPOCH=1700000000 flapi pack --in fixture --out out-b
sha256sum out-a == sha256sum out-b   # asserted

The Windows job uses pwsh with Get-FileHash instead of sha256sum;
fixture YAML is written via PowerShell here-strings.

macOS-specific assertions

# Pre-condition: the unbundled binary carries the link-time placeholder.
otool -l bin/flapi | grep -q "segname __FLAPI"
otool -l bin/flapi | grep -q "sectname __bundle"

# Default pack uses reserved-segment mode -- notarisable.
flapi pack --in fixture --out out-segment
codesign --verify --strict out-segment        # NOTARISATION PRECONDITION

# Legacy --macos-append still produces a runnable artifact (ad-hoc only).
flapi pack --in fixture --out out-append --macos-append
out-append info | grep -q "flapi.yaml"

# Oversized payload is rejected with a corrective error.
dd if=/dev/urandom of=fixture/data/huge.bin bs=1m count=32
flapi pack --in fixture --out out-too-big   # non-zero exit
grep -qi "FLAPI_RESERVED_BUNDLE_MIB" err.txt
grep -Eqi "reserved|exceeds" err.txt

Why no reproducibility on macOS

codesign may include non-deterministic data in the signature blob
(designated requirement timestamps, optionally embedded timestamps,
etc). Linux and Windows just append a deterministic archive after the
host bytes -- reproducibility is by construction. The macOS jobs
still validate every other invariant, just not byte-equal pack output.

What integration-tests already covers (unchanged)

The existing integration-tests job on ubuntu-24.04 auto-picks up the
pytest files added in this stack:

• test_self_packaging.py from test(self-packaging #46): integration tests for round-trip behaviours #56 -- 8 cases covering pack /
  info / unpack / idempotence / truncation / secret deny list
• test_env_overrides.py from feat(self-packaging #47): 12-factor env vars FLAPI_CONFIG + FLAPI_LOG_LEVEL #57 -- 6 cases covering
  FLAPI_CONFIG + FLAPI_LOG_LEVEL precedence
• test_self_packaging_macos.py from feat(self-packaging #48): macOS notarised via reserved Mach-O segment #58 -- 4 cases, auto-skipped
  on non-Darwin

That job is left unchanged -- pytest discovery picks the new files up
for free.

Test plan

• YAML syntax validates (yaml.safe_load).
• Linux x86_64 / Linux ARM64 / macOS / Windows CI legs all green
  on this branch.
• On a tag push, create-release waits for the new jobs.

This is the first PR in the stack where I can't usefully validate
end-to-end locally (no macOS / Windows / ARM64 box). The bash and
pwsh scripts are based on the existing smoke-test patterns in this
file, which already run reliably across all four legs.

Closes #49. Part of #40. Stacked on #58.