Make macOS release execution headless

[luca-ctx]

Summary

• replace the interactive quarantine execution check with exact-byte signed CLI execution on native macOS
• rename the evidence method and Buildkite artifact so it states exactly what was proven
• retain strict codesign, Developer ID attestation, Accepted notarization, checksum, and packaged-runtime checks

Root cause

The Safari-style 0081 quarantine marker deliberately triggers Finder/Gatekeeper first-open consent. On the physical Apple Silicon release host, syspolicyd completed its online scan successfully and then logged Prompt shown ... waiting for response; a headless SSH job therefore waited until any timeout. Raising the timeout could never make this an honest unattended gate.

The hosted installer uses curl and does not simulate Finder. This change keeps the automated release claim narrow: exact signed bytes execute on native macOS, while signing/notarization are verified separately.

Validation

• macOS signing contract suite passes
• Buildkite pipeline contract passes
• exact 12-target public Buildkite-equivalent gate passes
• physical-host security logs confirm the removed wait was an interactive prompt, not CLI startup or notarization latency