Add real Apple Container integration gate

[euforic]

Summary

• add an owned Apple Container integration harness that starts a uniquely named real container, exports the resolver test contract, and removes only that container on every exit path
• strengthen the real resolver test by dialing the private container endpoint returned by the production Apple CLI resolver
• add a manually confirmed self-hosted Apple silicon workflow so ordinary hosted CI remains unaffected
• document the local and GitHub Actions integration paths

Runtime evidence

Verified locally on Apple silicon macOS 27 with Apple Container CLI and apiserver 1.2.2. The harness started docker.io/library/nginx:alpine, exported PORTLESS_TEST_CONTAINER and PORTLESS_TEST_CONTAINER_PORT=80, resolved the live private address through container inspect, connected to port 80, and confirmed deletion of the exact UUID-named container. A deliberate unopened-port failure also returned nonzero and left no integration container behind.

Validation

• ./scripts/test-apple-container-integration
• deliberate failure cleanup with PORTLESS_TEST_CONTAINER_PORT=81
• bash -n scripts/test-apple-container-integration
• actionlint .github/workflows/*.yml
• go fmt ./...
• go vet ./...
• go test -count=1 ./...
• go test -race -count=1 ./...
• golangci-lint run --timeout=5m
• go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
• go mod tidy with a clean module diff

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.