fix(release): separate macOS integrity boundaries

[LeXwDeX]

Closes #498

Why

The release archive hash and the installed macOS binary hash represent different trust boundaries. The installer verifies SHA256SUMS before extraction, then macOS may mutate the binary through quarantine clearing and ad-hoc re-signing. Acceptance must verify archive integrity before extraction and signature validity after installation without treating byte equality as a stable signature-validity boundary.

What changed

• added a zero-network B1 harness proving archive hash mismatch fails before extraction
• added a Darwin B2 harness exercising the real xattr/re-sign path, strict signature verification, a negative control, and executable smoke
• wired B1 into Typecheck CI and B2 into the macOS release build
• documented the two trust boundaries in English and Chinese
• made oc sourceable for the harness while preserving direct execution behavior

Evidence

• bash script/oc-install-boundary.test.sh → 9 passed, 0 failed
• bash script/oc-macos-acceptance.test.sh → 6 passed, 0 failed
• bash -n oc script/oc-install-boundary.test.sh script/oc-macos-acceptance.test.sh
• git diff --check
• commit hooks: root lint + full workspace typecheck passed
• final DAG review: ACCEPT, fingerprint b48fc5610e77de4978328f3361b44d7be6ff7658d9fb5ff6b69f8738967f0694

Checklist

• archive/SUMS mismatch fails closed before extraction
• matching archive installs and smokes
• macOS re-sign path validates with codesign --verify --strict
• negative control proves signature assertion is non-vacuous
• no installed-binary-versus-payload hash comparison or post-sign digest
• bilingual docs state only evidence-backed modal claims