ci: add macOS test job (#366)

* ci: add macOS test job

Darwin-tagged tests (Seatbelt translator, diagnostics, upcoming network
lockdown tests) never ran in CI: the test matrix covered ubuntu and
windows only. The M0 sandbox lockdown milestone is macOS-first, so macOS
coverage must exist before enforcement work lands.

Also establishes the convention that darwin integration tests requiring
sandbox-exec must fail (not skip) when running in CI, so missing tooling
cannot silently hide security tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

* test(sandbox): make Seatbelt render golden test machine-independent

The golden file baked the authoring machine's HOME, CWD and TMPDIR parent
into the expected profile, so TestRenderSeatbelt_Golden could only pass on
that machine. It never ran in CI before the macOS job exposed it.

Normalize CWD, home and TMPDIR parents (raw and query-escaped forms) to
stable placeholders before comparison, longest path first so prefix
overlaps survive, and rewrite the golden accordingly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

* ci: make setup-go cache explicit in macOS job

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

---------

Co-authored-by: Claude <noreply@anthropic.com>

sandbox/platform/seatbelt_render_darwin_test.go

@@ -4,13 +4,18 @@
 package platform
 
 import (
+	"bytes"
+	"net/url"
 	"os"
 	"path/filepath"
 	"regexp"
+	"sort"
+	"strings"
 	"testing"
 
 	"github.com/safedep/dry/utils"
 	"github.com/safedep/pmg/sandbox"
+	"github.com/safedep/pmg/sandbox/util"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -19,8 +24,44 @@ import (
 // comparisons are deterministic across runs.
 var seatbeltLogTagPattern = regexp.MustCompile(`PMG_SBX_[A-Za-z0-9]+`)
 
-func normalizeSeatbeltOutput(b []byte) []byte {
-	return seatbeltLogTagPattern.ReplaceAll(b, []byte("PMG_SBX_GOLDENXXXXXX"))
+// normalizeSeatbeltOutput makes renders comparable across machines: the
+// random log tag, the CWD and home directory anchoring the dangerous-path
+// rules (both raw and query-escaped in violation markers), and the TMPDIR
+// parents are replaced with stable placeholders. Longer paths are replaced
+// first so prefix overlaps (CWD under home, /private variants) stay intact.
+func normalizeSeatbeltOutput(t *testing.T, b []byte) []byte {
+	t.Helper()
+
+	out := seatbeltLogTagPattern.ReplaceAll(b, []byte("PMG_SBX_GOLDENXXXXXX"))
+
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+	home, err := os.UserHomeDir()
+	require.NoError(t, err)
+
+	subs := []struct{ real, placeholder string }{
+		{cwd, "/PMG_GOLDEN_CWD"},
+		{home, "/PMG_GOLDEN_HOME"},
+	}
+	for _, parent := range util.GetTmpdirParent() {
+		placeholder := "/PMG_GOLDEN_TMPDIR"
+		if strings.HasPrefix(parent, "/private/") {
+			placeholder = "/private/PMG_GOLDEN_TMPDIR"
+		}
+		subs = append(subs, struct{ real, placeholder string }{parent, placeholder})
+	}
+	sort.SliceStable(subs, func(i, j int) bool {
+		return len(subs[i].real) > len(subs[j].real)
+	})
+
+	for _, sub := range subs {
+		out = bytes.ReplaceAll(out, []byte(sub.real), []byte(sub.placeholder))
+		out = bytes.ReplaceAll(out,
+			[]byte(url.QueryEscape(sub.real)),
+			[]byte(url.QueryEscape(sub.placeholder)))
+	}
+
+	return out
 }
 
 func TestRenderSeatbelt_Golden(t *testing.T) {
@@ -51,7 +92,7 @@ func TestRenderSeatbelt_Golden(t *testing.T) {
 			require.NoError(t, err)
 
 			goldenPath := filepath.Join("testdata", tc.goldenFile)
-			normalized := normalizeSeatbeltOutput(got)
+			normalized := normalizeSeatbeltOutput(t, got)
 
 			if os.Getenv("UPDATE_GOLDEN") != "" {
 				require.NoError(t, os.WriteFile(goldenPath, normalized, 0o644))