Add macOS Apple Silicon (aarch64-darwin) Habitat build & promote pipelines

[sanghinitin]

Summary

Add Expeditor/Buildkite pipelines to build and promote the chef-vault Habitat package for macOS Apple Silicon (aarch64-darwin).

This follows the same pattern used by habitat-sh/habitat for their aarch64-darwin builds — using native macOS Anka VMs instead of Docker containers.

Changes

File	Description
.expeditor/build.habitat.aarch64-darwin.pipeline.yml	Buildkite pipeline definition for building aarch64-darwin habitat package using Anka VM
.expeditor/buildkite/build_hab_aarch64_darwin.sh	Build script that installs hab natively on macOS ARM and runs hab pkg build
.expeditor/buildkite/upload_hab_aarch64_darwin.sh	Uploads the built .hart artifact to habitat builder (unstable channel)
.expeditor/promote.habitat.aarch64-darwin.pipeline.yml	Pipeline definition for promoting aarch64-darwin package between channels
.expeditor/buildkite/promote_hab_aarch64_darwin.sh	Promotes aarch64-darwin package via Builder API (auto-detects channels from Expeditor env vars)

Key Design Decisions

• Anka VM (chef/anka#v0.7.2 with buildkite-core-14-arm64) instead of Docker — required for native aarch64-darwin .hart production
• Agent queue: default-macos-arm64-privileged — targets Apple Silicon runners
• vault-util-init for secrets initialization (standard Buildkite/Expeditor pattern)
• hab installed with -t aarch64-darwin target flag for correct platform binary
• Key sync to /hab/cache/keys so root-level builds can access signing keys

Lint Validation

Shellcheck (shell scripts)

$ shellcheck .expeditor/buildkite/build_hab_aarch64_darwin.sh \
             .expeditor/buildkite/upload_hab_aarch64_darwin.sh \
             .expeditor/buildkite/promote_hab_aarch64_darwin.sh

SC1091 (info): Not following: ./results/last_build.env — runtime-generated file
SC2154 (warning): pkg_artifact referenced but not assigned — defined in sourced last_build.env

Both are expected false positives (variables from runtime-sourced last_build.env).

YAML Validation

$ ruby -ryaml -e "YAML.safe_load(...);"
YAML validation: PASSED

Testing

• No Ruby code changed — existing RSpec/Cucumber tests unaffected
• Pipeline correctness will be validated on first Buildkite trigger

[github-actions]

Simplecov Report

Covered	Threshold
98.57%	90%

[rishichawda]

You'll need to add a plan file first. Also, if this is not urgent, then we should explore the possibility of waiting till expeditor has support for darwin builds via bldr.toml

[rishichawda]

I believe pipeline definition is missing in config.yml. See https://expeditor.chef.io/docs/pipelines/habitat/#create-pipeline