Add full macOS compatibility

[NicholaiVogel]

Summary

• add Darwin-safe directory descriptor traversal and /var//tmp//etc canonicalization without weakening symlink checks
• use macOS renameatx_np primitives for no-replace installs and atomic directory exchange
• add Darwin config publication and PTY/terminal cleanup paths
• add macOS compatibility coverage and regenerate bun.lock for Bun 1.3
• install the worker Ctrl-C handler before publishing its running lease to avoid a Darwin startup race
• add required macOS CI coverage on both arm64 (macos-14) and Intel (macos-15-intel)

Validation

Local validation on macOS 26.5, Intel x86_64:

• cargo build
• cargo build --features test-hooks --target-dir target/test-hooks
• cargo test --all-targets
• cargo clippy --all-targets --all-features -- -D warnings
• bunx tsc --noEmit
• bun install --frozen-lockfile --ignore-scripts
• bun test --max-concurrency=1 --timeout=30000 — 85 passed, 0 failed

CI validation added by .github/workflows/macos.yml:

• locked Rust build and test-hook build
• Rust tests, clippy, and TypeScript checks
• serialized full Bun integration suite on both macOS architectures