ci: publish native macOS arm64 release artifact

[elibosley]

Summary

• Add a native macOS arm64 release artifact built on the GitHub-hosted macos-15 runner.
• Make the shell installer and npm launcher resolve aarch64-apple-darwin.
• Document labby mcp as a local stdio bridge to a running labby serve daemon, including standalone fallback and explicit-target fail-closed behavior.
• Correct the stdio client example to use args: ["mcp"].

Validation

• RUSTFLAGS='-D warnings' cargo check --workspace --all-features --locked --target aarch64-apple-darwin
• cargo test -p labby --test ci_changed_paths release_tool_downloads_are_version_and_digest_pinned --locked
• just docs-check
• npm test --prefix packages/labby-mcp
• npm run check --prefix packages/labby-mcp
• Actionlint, ShellCheck, shell syntax, Rust formatting, toolchain, retired-feature, and diff checks

Test note

The full macOS-target labby-codemode unit suite had 267 passing tests and one failure in the existing mocked Microsandbox reconciliation test: reconciliation_removes_dead_owner_and_preserves_live_owner. The release target workspace check passes with warnings-as-errors.

[jmagar]

ARM64 support is now intentional and required, so the existing no-ARM fleet contract is stale. Please update the authoritative fleet/repository policy and its contract checks to permit the scoped macOS ARM64 target introduced here. Keep unsupported ARM/QEMU combinations denied, and add required PR-time macOS ARM64 compile, package, checksum, install, and Code Mode smoke coverage so the target is validated before release.published.