Fix dual-architecture runtime releases

[SunChJ]

What changed

• materialize safe in-bundle directory symlinks when archiving the self-contained macOS runtime, while continuing to reject dangling, cyclic, escaping, and special-file entries
• cap ONNX Runtime at the newest line with both macOS arm64 and x86_64 Python 3.12 wheels
• run the real native runtime build and extracted smoke test for both architectures on pull requests
• require release tags to match the project version and point to a commit in main history
• prepare the replacement downstream release 0.6.4+gloss.4 without moving the failed 0.6.4+gloss.3 tag

Root cause

The first 0.6.4+gloss.3 release run failed before publication for two independent reasons: ONNX Runtime 1.27.0 does not publish a macOS Intel wheel, and the hardened archive builder rejected the internal Python.framework/Resources directory alias emitted by PyInstaller.

Impact

Both native runtime variants are now built and smoke-tested before merge. A successful merge can be tagged as v0.6.4-gloss.4 to publish the signed runtime manifest and dual-architecture archives consumed by Gloss.

Validation

• uv lock --check
• uv sync --frozen --dry-run --no-default-groups --group release --python-platform x86_64-apple-darwin
• uv sync --frozen --dry-run --no-default-groups --group release --python-platform aarch64-apple-darwin
• uv run ruff check .
• uv run pytest -q — 140 passed
• uv build --wheel --sdist
• release workflow YAML parsed locally