ci(github): add strict macOS verification

[thesongzhu]

What changed

• add a least-privilege macOS GitHub Actions workflow for the Rust workspace and Swift effect-broker bridge
• pin actions/checkout to a full commit and Rust to 1.96.0
• record the runner, Xcode, and Swift versions before running the strict test, release-build, lint, format, plist, and tracked-diff checks
• synchronize the README, Build Week disclosure, provenance map, master-plan ledger, and acceptance ledger with the reviewed bootstrap state

Why

The reviewed bootstrap commit was pushed to the new public repository without a GitHub Actions workflow. Local verification was real, but no remote test result existed. This PR adds the smallest complete remote verification slice without representing CI as signed-build, cross-UID, product-E2E, or release proof.

User and developer impact

Pull requests and pushes to main will run one bounded macos-26 verification job with read-only repository permissions. The workflow does not deploy, publish, sign, notarize, access secrets, or mutate repository contents.

Validation

• 95 Rust tests passed in disposable local builds
• 25 Swift tests passed in disposable local builds
• Rust fmt, release build, and strict Clippy passed
• Swift warnings-as-errors test/release builds, strict format, and plist lint passed
• workflow YAML parse, whitespace checks, and concrete credential-format scan passed
• two fresh isolated CI reviewers (Reviewer E and Reviewer F) passed the final reviewed tree

Proof boundary

This closes OPENOPEN-CI plumbing only. It does not prove signed/admin installation, the protected cross-UID/XPC boundary, notarization, real ChatGPT/iMessage/Discord/Reminders/XLSX routes, clean-machine installation, external-user validation, or PRODUCT_READY_FOR_DEMO.

Surgical-change record

• Closed ID: OPENOPEN-CI
• Surgical-change rules bent: none

Merge safety

• This PR is draft-only while its real Actions run is inspected.
• No owner/admin bypass is authorized or requested.
• Do not merge through --admin or an implicit owner bypass.
• Merge remains gated by the repository rules, inspected CI, the project release-proof requirements applicable at merge time, and the recorded reviewer trail.

[thesongzhu]

Current PR-head CI evidence — 2026-07-14

• PR head: 923c88abb6099267d1e636544de4d6bb4814c5e0
• Base: 19ecdd9c290dd685f1e79ff525c71b8d38504db8
• Actions run: 29370433505 — success
• Actual pull_request checkout: synthesized merge d502b3d977146ebd3a25358b52b86c07bbd271e3
• Head tree = synthesized-merge tree: ecc50fa5d84843d1ddaed22438f25cd090f99679

The 2m52s job passed every step: 95 Rust tests, Rust release build/fmt/strict Clippy, 25 Swift tests, Swift warnings-as-errors release build, strict format, LaunchDaemon plist lint, and clean tracked diff. The runner reported macOS 26.4, Xcode 26.5, Swift 6.3.2, and Rust 1.96.0.

This is inspected PR integration-tree CI plumbing for the current PR content. It is not direct exact-head/current-SHA release proof and does not prove signed/admin installation, cross-UID/XPC isolation, notarization, real ChatGPT/iMessage/Discord/Reminders/XLSX routes, clean-machine installation, external-user validation, or PRODUCT_READY_FOR_DEMO.

The final evidence wording received two fresh isolated reviewer PASS reports after the merge-ref distinction was corrected. The PR remains draft. No owner/admin bypass or merge action is authorized.