ci: add macOS test job (#366)

* ci: add macOS test job

Darwin-tagged tests (Seatbelt translator, diagnostics, upcoming network
lockdown tests) never ran in CI: the test matrix covered ubuntu and
windows only. The M0 sandbox lockdown milestone is macOS-first, so macOS
coverage must exist before enforcement work lands.

Also establishes the convention that darwin integration tests requiring
sandbox-exec must fail (not skip) when running in CI, so missing tooling
cannot silently hide security tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

* test(sandbox): make Seatbelt render golden test machine-independent

The golden file baked the authoring machine's HOME, CWD and TMPDIR parent
into the expected profile, so TestRenderSeatbelt_Golden could only pass on
that machine. It never ran in CI before the macOS job exposed it.

Normalize CWD, home and TMPDIR parents (raw and query-escaped forms) to
stable placeholders before comparison, longest path first so prefix
overlaps survive, and rewrite the golden accordingly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

* ci: make setup-go cache explicit in macOS job

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

---------

Co-authored-by: Claude <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -40,6 +40,30 @@ jobs:
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
+  # Runs the darwin-tagged tests (sandbox/platform/*_darwin_test.go) that no
+  # other job can execute. Convention for darwin integration tests requiring
+  # sandbox-exec: fail instead of skip when running in CI
+  # (os.Getenv("CI") != "" => t.Fatal) so missing tooling cannot silently
+  # hide security tests.
+  test-macos:
+    timeout-minutes: 15
+    runs-on: macos-latest
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Build and Test
+        run: |
+          go mod tidy
+          go build
+          go test -count=1 -v ./...
+
   test-windows:
     timeout-minutes: 15
     runs-on: windows-latest