fix(macos): enforce portable release packages

[darwin67]

Summary

• reject packaged Mach-O deployment targets newer than the declared app minimum and non-portable absolute load dependencies
• build from the Nix development shell with the host Apple compiler and SDK instead of embedding Nix store libraries
• align the macOS package minimum to 13.0, matching pinned PDFium, and document the supported release boundary
• add regression coverage for executable/PDFium minimum versions, Nix dependencies, and PDFium’s relative install name

Validation

• cargo fmt --all -- --check
• cargo check --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace --all-targets --no-fail-fast — 421 passed
• make test-scripts — 10 passed
• native Apple Silicon macOS release build, package checker, Mach-O inspection, codesign, packaged-app startup, and PDFium load smoke
• native Framework 16 Linux release build, package checker, and extracted-app runtime smoke
• nix flake check --no-build on x86_64 Linux