build: add macOS subscription prerelease

[PurplePrintAI]

What changed

• adds a fork-specific macOS DMG workflow for Apple Silicon and Intel
• pins the reviewed whisper runtime producer run to avoid the tag-build race
• verifies native payloads, bundle identity, architecture, signature structure, CLI boot, and mounted DMG
• finds Codex and Claude CLIs from Finder-safe user and Homebrew paths
• documents ad-hoc signing, Gatekeeper, permissions, and the real-Mac validation boundary
• keeps subscription tags out of upstream-oriented build and Discord release paths

Why

The first public fork release contained only a Windows installer. The inherited macOS pipeline raced its speech-runtime producer and also packaged with upstream defaults. This creates a separate, auditable prerelease path under the fork identity.

Verification

• npm run test: 2,243 passed, 4 skipped (189 files)
• npx tsc --noEmit
• npx tsc -p tsconfig.test.json --noEmit
• npm run lint (14 existing warnings)
• npm run i18n:check
• npm run docs:check
• targeted Codex/Claude CLI discovery tests: 24 passed
• shell and workflow YAML syntax checks

Release boundary

The first DMGs will be ad-hoc signed and not Apple-notarized. They remain a prerelease until a real Mac completes record → edit → export and permission checks.