ci: add macOS (Apple Silicon) sidecar build/test job

[abcxff]

What

Adds .github/workflows/macos-build.yml — a stage-0 compile gate for macOS support, running on macos-14 (Apple Silicon / aarch64-apple-darwin).

It mirrors ci.yml's setup (checks out the secure-exec sibling repo, symlinks it to the expected sibling path, builds @secure-exec/core, then pnpm install && pnpm build) and then runs the real signal:

• cargo build -p agent-os-sidecar — transitively compiles the secure-exec native stack (kernel / execution / V8 runtime) it links
• cargo test -p agent-os-protocol and cargo test -p agent-os-sidecar

Why

There is currently no macOS build or test anywhere in CI. Before investing in per-platform binary packaging and a release matrix, we need a definitive answer to "does the native stack even compile and pass tests on Apple Silicon?". This job provides that signal.

Notes

• Not a required check. Triggers only on workflow_dispatch and on pushes/PRs that touch crates/**, Cargo.*, or this workflow file (macOS runners are expensive).
• The bulk of native macOS-porting risk lives in secure-exec (kernel/execution/v8-runtime); this gate exercises it transitively via path deps, but secure-exec likely wants its own equivalent gate.

🤖 Generated with Claude Code

[railway-app]

🚅 Deployed to the agentos-pr-1507 environment in agentos

Service	Status	Web	Updated (UTC)
agentos	😴 Sleeping (View Logs)	Web	Jun 24, 2026 at 12:49 pm

---

🚅 Deployed to the agentos-pr-1507 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
agent-os	😴 Sleeping (View Logs)		Jun 22, 2026 at 6:31 pm