fix: validate universal app binaries with supported lipo order (#45)

[bigduu]

Summary

• use Xcode lipo's supported input-file-first -verify_arch grammar for both the source universal executable and the copy installed into Nova.app
• make the hermetic release-workflow fixture reject the historical operation-first ordering
• verify exactly two successful architecture checks and reject an arm64-only fixture before signing or archive creation

Closes #45

Test plan

Automated / hermetic

• git diff --check
• bash -n packaging/macos/package-development-app.sh scripts/test-release-workflow.sh
• scripts/test-release-workflow.sh
  • release YAML/DAG/shell checks
  • release-tag integrity checks
  • universal mock app assembly/signing/archive checks
  • explicit rejection of lipo -verify_arch arm64 x86_64 <input>
  • exact input-file-first calls for source and app-copy verification
  • thin mock binary rejection before codesign/archive
• adversarial regression run: applied only the strengthened test to a detached baseline worktree while retaining the old production syntax; the suite failed before the packaging success marker

Real macOS/Xcode acceptance

Used the installed universal nova 0.2.1 executable (x86_64 arm64):

• supported form lipo <binary> -verify_arch arm64 x86_64 exited 0
• historical form exited 1 and parsed the binary path as an architecture
• full development app packaging succeeded to an isolated /tmp output
• independently verified:
  • app executable remains x86_64 arm64
  • strict ad-hoc codesign verification
  • com.zenith.nova bundle identity and exact 0.2.1 plist fields
  • executable --version / --help
  • all 10 icon representations
  • required archive members and checksum
• created a real arm64-only Mach-O; direct verification and full packaging both exited 1, no zip/checksum was emitted, and xtrace confirmed the script stopped at the source lipo check before codesign or ditto

Non-goals

• no version bump or release publication
• no Developer ID, hardened runtime, notarization, or stapling changes
• no updater or application lifecycle changes