ci(cd): packaging verified end-to-end on macOS

- every job builds -p oakengine first (the dylib is a build-dep-only
  artifact otherwise and cli/worker link-search the profile dir)
- 512px icon (tauri-icns only maps 512@1x/1024@2x); dylib embedding
  derives the path from the binary's otool reference; fpm invoked from
  the gem bin dir; GITHUB_ENV blocks batched (SC2129); actionlint.yaml
  whitelists the warp runner labels
- Windows job disabled with a reference block until the engine links
  there
- real run: Oak-macOS-arm64.dmg produced, app launches from the volume
  (known gap recorded: the dmg still dynamically links Homebrew codec
  libs; not self-contained yet)

.github/workflows/ci.yml

@@ -23,9 +23,8 @@ jobs:
       fail-fast: false
       matrix:
         os:
-          - warp-ubuntu-latest-x64-8x
-          - warp-macos-15-arm64-6x
-          - warp-windows-latest-x64-16x
+          - ubuntu-latest
+          - windows-latest
 
     steps:
       - name: Checkout