.github: build: Stabilize macOS release pipeline

[René Dudfield (illume)]

Summary

Repair both blockers observed in macOS build 247846.

The Intel job failed before installation because Azure Cache@2 resolved plugins/*/package-lock.json to zero files. The ARM64 job could not allocate an agent from the configured GitHub-hosted Agents pool.

Changes

• Replace the failing npm lockfile wildcard with explicit tracked lockfiles for the root, Headlamp source helper, and installed plugins.
• Bump the immutable npm cache namespace from v1 to v2.
• Disable Build_arm64 at the stage boundary while no Apple Silicon agent is available. Its signing, notarization, and qualification stages remain dependency-gated.
• Strengthen the pipeline regression test to reject wildcard npm cache inputs and require the ARM availability gate.

Verification

• All 5 focused build/macos-pipeline.test.ts tests pass.
• The edited YAML parses successfully.
• Azure Pipelines definition 1000 preview compiled the exact YAML and expanded both npm cache tasks. No run was created by preview.
• Every explicit cache input is tracked at checkout.
• git diff --check and editor diagnostics pass.
• Direct self-review confirms Build_x64 remains independent and enabled.

Limitation

This restores the Intel release path; it does not produce an ARM64 artifact. The project GitHub-hosted Agents pool currently reports zero agents, and prior build 247834 could not route the ARM64 image through the standard Azure Pipelines pool. Restore ARM64 only after a live Apple Silicon agent is provisioned and qualified.

[René Dudfield (illume)]

Superseded by the direct macOS cache fix in #977. No commits from this experimental branch were cherry-picked.