Add universal macOS release verification

[jmcte]

Summary

• Adds a universal macOS release build helper that builds apw for aarch64-apple-darwin and x86_64-apple-darwin, combines the CLI with lipo, and builds APW.app with SwiftPM --arch arm64 --arch x86_64.
• Adds a lipo verifier plus a fake-lipo regression test, and wires the verifier into fast checks and the release workflow.
• Keeps universal release builds on the vendored OpenSSL path, with a fast contract test proving the release helper no longer depends on Homebrew/pkg-config OpenSSL discovery.
• Updates local release packaging and release docs so archives are expected to contain universal CLI and app binaries.

Closes #53.

Verification

• bash scripts/test-verify-universal-binaries.sh
• bash scripts/test-universal-release-config.sh
• bash -n scripts/build-universal-release.sh scripts/test-universal-release-config.sh scripts/ci/run-fast-checks.sh
• bash -n scripts/build-native-app.sh scripts/build-universal-release.sh
• bash scripts/ci/run-fast-checks.sh
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml")'
• git diff --check
• ./scripts/build-universal-release.sh
  • verified apw: x86_64 arm64
  • verified APW.app: x86_64 arm64
• ./scripts/build-apw-release.sh --skip-version --no-archive-smoke
  • produced dist/apw-macos-v2.0.0.tar.gz
  • verified apw: x86_64 arm64
  • verified APW.app: x86_64 arm64

Notes

• Full hardware smoke on both Intel and Apple Silicon should still be captured during an actual signed/notarized release run.

[pheidon]

Approved from Pheidon second-pass review. Universal release verification has dedicated script/test coverage and the full PR Fast CI, Rust, and Native App Swift checks are green.