Build, sign and publish Whiteboard for Intel Macs

[thesiti92]

Adds a signed, notarized, auto-updating Whiteboard build for Intel Macs (darwin-x64), alongside the Apple silicon build. Closes #614.

How it builds

• The Linux payload compile now produces curated extensions for both chips, in one darwin-payload.tar.zst.
• The macOS build job is a matrix. darwin-arm64 runs on macos-15-xlarge with a 90-minute timeout. darwin-x64 runs natively on macos-15-large, the Intel larger runner, with a 150-minute timeout.
• The scripts derive the target from the host arch (darwin-arch.sh, darwinTarget()) instead of hardcoding darwin-arm64.
• R2 uploads move to a new publish-macos job, which needs the whole matrix.
  • Payloads for both chips upload first, and both latest.json files last.
  • If either chip fails, nothing publishes.
  • finalize-release and tag-preview now wait on publish-macos.
• New live checks confirm the Intel feed (clients send plain darwin) and the Intel DMG alias.

Wrong-arch guard

• validate-release-artifacts.mjs now runs lipo -archs on the app executable, the bundled diffr, and every native executable declared by a bundled curated extension (currently ty and ruff).
• Codesign would accept an arm64 binary inside the Intel app. This check catches it before publishing.

Dependencies (already live)

• diffr 0.1.4 ships x86_64-apple-darwin (Build diffr for Intel Macs diffr#40, Backport VS Code security and reliability fixes #41, Prewarm tutorial reviews without blocking open #42), and this PR bumps to it.
• The update Worker maps the Intel client's darwin feed id to update/<channel>/darwin-x64/latest.json (Fix-Fast/dev#1102). It is deployed, and it answers 204 until the first Intel release.
• The install-page Intel row is Fix-Fast/dev#1103. It is held until the Intel DMG links return 200.

Worth knowing

• An Intel build under Rosetta on Apple silicon asks for darwin, so it keeps getting Intel updates. This is correct; please don't "fix" it.
• The C# extension's darwin-x64 VSIX from upstream ships an arm64-only netcoredbg. C# debugging won't work on Intel Macs. It is not arch-asserted, on purpose.
• GitHub keeps Intel macOS runners until about August 2027. After that, the Intel leg has to cross-build on arm64.
• publish-linux and publish-windows now run in parallel with publish-macos. Before, they started only after the Mac publish.
• Removed change-detector assertions (per AGENTS.md), each in curated-extensions.test.mjs, where it grepped script source text:
  • the $DARWIN_PAYLOAD_CURATED_EXTENSIONS_PATH ordering check;
  • --target=darwin-arm64 in compile-darwin-payload.sh;
  • target: "darwin-arm64" in validate-release-artifacts.mjs, and REVIEW_DESKTOP_CURATED_EXTENSION_TARGET=darwin-arm64 in compile-darwin-payload.sh.
    Tell me if any should be replaced with a behavioral test.
• Tester artifacts: the preview dry-run tester DMG artifact is now macos-darwin-arm64 / macos-darwin-x64, instead of review-desktop-preview-<v>-dmg.

Verification

• node --test apps/review-desktop/scripts/*.test.mjs passes, apart from the existing yazl baseline failure.
• actionlint, root lint and format are clean.
• All four new Intel VSIX pins were checked against Open VSX (three were re-hashed independently). Materializing them yields x86_64 binaries.
• The Intel end-to-end proof is the dry-run preview dispatch from this branch, on real Intel hardware.