v0.1.0-alpha.23 — first macOS arm64 build

First public macOS arm64 release.

Linux users: this release ships macOS arm64 only. Stay on v0.1.0-alpha.22 — running mclovin update will return a clear "no `mclovin-linux-x86_64` asset" message and leave your install untouched. A combined Linux + macOS release lands as alpha.24 once the macOS path is validated.

macOS users (first install):
```
curl -fsSL https://mclovin.org/install.sh | bash
```
Requires Xcode Command Line Tools (`xcode-select --install`) so `mclovin setup` can compile the .app's URL-event launcher.

What's in this release (full diff from alpha.22):

• macOS port: browser detection via .app bundles, profile injection
  (Finicky's `-n --args --profile-directory` recipe), Swift launcher
  for kAEGetURL Apple Events, register-as-default flow via System
  Settings (macOS 26 blocks programmatic `setDefaultApplication` for
  unsigned apps), bundled webapp `--app=URL` mode, GUI keybindings
  with Cmd/, settings window centered via NSScreen visibleFrame,
  picker icons from .icns via sips.
• Auto-update: macOS arm64 asset selector, strips
  `com.apple.quarantine` xattr post-install so Gatekeeper doesn't
  block the next launch.
• Linux benefits too (all cfg-gated, no behavior change on Linux):
  Phase 1 `DefaultBrowserPoll` gated per-screen + interval 1Hz → 5Hz
  (less `xdg-mime` fork churn idle); `is_chromium_family` switched
  from substring to token-exact (kills false positives like `arc`
  matching `monarch`); profile flags now skipped when no URL is in
  flight (was forcing a new browser window on profile-pick from
  picker).

Known limitations:

• Auto-update Mac depends on this release pipeline catching up — first
  install via curl works today, in-app update from a previously-installed
  alpha.23 will be validated as soon as alpha.24 ships.
• Settings window centers on the primary display (multi-monitor centering
  on the window's actual screen is deferred).
• Code signing / notarization not done — Gatekeeper quarantine is
  stripped at install time but signed builds (Developer ID) are the
  proper long-term fix.