ci(cli): add lightweight macOS test gate

[limityan]

Summary

• expand the existing CLI test job into independent Ubuntu and macOS matrix entries
• preserve the full Ubuntu CLI, ACP, Agent Runtime, SDK Host, and terminal cleanup coverage
• add a lightweight macos-15 gate that runs bitfun-cli and bitfun-acp tests
• isolate Rust caches per operating system while keeping pull-request caches read-only

Why

The ordinary CI workflow only had a dedicated Ubuntu CLI gate. The workspace-wide macOS job checks compilation and broader Rust behavior, but it does not run the CLI and ACP test suites directly. This adds focused macOS CLI coverage without copying release packaging or the longer Ubuntu-only suites into the new job.

The new matrix entry starts immediately alongside the existing jobs, keeps the 15-minute timeout, and uses fail-fast: false, so it should not extend the current Windows-dominated CI critical path.

Validation

• pnpm run check:github-config
• pnpm run check:repo-hygiene
• focused YAML structure and Ubuntu-equivalence contract check
• git diff --check gcwing/main...HEAD

Impact

Pull requests and pushes to main gain a distinct CLI Tests (macos-15) check. The existing CLI Tests (ubuntu-latest) name, commands, cache key, and activation policy remain unchanged.

Repository branch protection or rulesets must list the new check as required if maintainers want it to block merges independently.