fix(ci): use dynamic matrix for macOS-on-main-only

[nori-sessions]

Summary

• Fixes Unrecognized named-value: 'matrix' error in rust-ci.yml introduced by ci: migrate to Blacksmith runners #487
• The matrix context is not available in job-level if conditions in GitHub Actions — it's only available for name, runs-on, env, and step-level expressions
• Replaces the static matrix + broken job-level if with a dynamic fromJSON matrix that conditionally includes the macOS entry only on non-PR events

What changed

Before (broken):

if: ${{ !matrix.main-only || github.event_name != 'pull_request' }}
strategy:
  matrix:
    include:
      - runner: blacksmith-4vcpu-ubuntu-2404
        main-only: false
      - runner: blacksmith-6vcpu-macos-15
        main-only: true

After (fixed):

strategy:
  matrix:
    include: ${{ github.event_name != 'pull_request'
      && fromJSON('[{linux}, {macos}]')
      || fromJSON('[{linux}]') }}

Same behavior: PRs get Linux-only CI, pushes to main get both Linux + macOS.

Test plan

• PR CI triggers Linux checks only (no macOS entry in matrix)
• Merge to main triggers both Linux + macOS checks