Support macOS and the BSDs, not just Linux

[jaredLunde]

Why

handoff's mechanism is plain POSIX — fork/exec FD inheritance, flock, Unix-domain control sockets, signals. None of it is Linux-only; the crate was just incidentally Linux-bound. This makes services that embed handoff build and run on macOS and the BSDs with no opt-in — automatic via #[cfg(target_os = …)], not a Cargo feature (an embedder shouldn't have to flip a flag to get a working build on their platform).

A full sweep of every libc::/nix:: call site found exactly one production break, two test breaks, and a docs cleanup. Everything else is uniform across Unix (verified: no pidfd/signalfd/prctl/epoll/memfd//proc in library code; FD handoff is fork/exec inheritance, not SCM_RIGHTS).

Changes

• supervisor.rs — make_socketpair() cfg-gates SOCK_CLOEXEC on the control socketpair. macOS doesn't define that flag (nix won't even compile the symbol there), so the macOS path creates the pair then sets FD_CLOEXEC via a follow-up fcntl. The Linux/BSD atomic path is unchanged. The non-atomic window on macOS is theoretical — this runs on the rare swap path, not under a fork storm.
• fd.rs — drops SOCK_CLOEXEC from a test socketpair (throwaway source FDs for the dup2-shuffle assertion; the flag isn't needed and isn't defined on macOS).
• stress.rs — FD-leak counter reads /dev/fd instead of /proc/self/fd. /dev/fd is the portable spelling: a symlink to /proc/self/fd on Linux, a real fdescfs on macOS and FreeBSD.
• CI — new macos-latest test job (runs unit + integration + stress, so it actually exercises the fcntl cloexec fallback and /dev/fd enumeration that cross-compilation can't), plus a FreeBSD cross-compile check (GitHub has no free BSD runner, so a type-check is the pragmatic proof the BSD path stays buildable).
• Docs — broadened the rename-atomicity note beyond Linux (APFS/UFS/ZFS hold the same guarantee); added a Platforms section.

Out of scope

Windows — no fork/exec FD inheritance, no flock. It would need a separate backend behind the Drainable API; that's a different decision, not requested here.

Verification (local, on Linux)

cargo check cross-compiles without an Apple/BSD SDK (type-check only, no linking):

• ✅ cargo check --workspace --all-targets --target aarch64-apple-darwin — proves the macOS cfg branch compiles and nothing else is silently Linux-bound
• ✅ cargo check --workspace --all-targets --target x86_64-unknown-freebsd
• ✅ Native Linux: full test suite passes (lib + integration + crash-matrix + stress + wire-race + slow-seal), clippy clean, fmt clean

The macOS CI job in this PR is what validates the macOS code paths running for real.

🤖 Generated with Claude Code