ci: add macOS quality gates and package smoke

[tuzuminami]

Closes #81

What changed

• Added a least-privilege, SHA-pinned GitHub Actions workflow for pull requests and pushes to main.
• Added macos-core for Python/Node/Rust/Swift plus repository quality gates.
• Added macos-package-smoke to build unsigned .app/.dmg artifacts and require valid zip, DMG, and checksums.
• Documented the two stable required-check names, fork safety, and the remaining [P0][Supply Chain] SBOM・transitive license・脆弱性・artifact provenanceをrelease gateにする #84/[P0][macOS][Security] 署名・notarization前提の配布パイプラインを整備する #57/[P0][Quality] packaged .appのclean Mac E2Eとv1 release acceptanceを強制する #85 boundaries.
• Linked the CI operating guide from both READMEs.

Verification

• Workflow structural/action-pinning/Rust shell validation
• npm --prefix apps/desktop ci --ignore-scripts
• cargo check --locked --manifest-path apps/desktop/src-tauri/Cargo.toml
• ./scripts/test.sh
• ./scripts/lint.sh
• ./scripts/check_licenses.sh
• ./scripts/check_no_external_network.sh

Merge follow-up

1. Wait for both macOS workflow jobs to pass on this PR and on main.
2. Require macos-core and macos-package-smoke on main.
3. Verify a controlled failing PR cannot merge.