[codex] publish Darwin sidecar and plugin artifacts

[NathanFlurry]

What changed

Adds Darwin publish support for the native AgentOS stack on top of the dylib integration branch:

• builds agentos-sidecar on darwin-arm64 and darwin-x64
• builds agentos-actor-plugin on Darwin and ships libagentos_actor_plugin.dylib
• adds Darwin npm platform packages for both sidecar and actor plugin
• updates sidecar/plugin runtime resolvers and publish package discovery tests
• pins AgentOS to secure-exec 0.3.1-rc.2 so the macOS build uses the Darwin-capable secure-exec preview

Why

macOS installs need both pieces: the AgentOS sidecar binary and the RivetKit-loadable actor plugin dylib. Shipping only the sidecar leaves @rivet-dev/agentos unable to load the native plugin on Darwin.

Validation

Local:

• pnpm --dir scripts/publish test
• pnpm --dir scripts/publish run check-types
• cargo build -p agentos-sidecar -p agentos-actor-plugin
• pnpm --filter @rivet-dev/agentos-core build && pnpm --filter @rivet-dev/agentos run check-types
• cargo test -p agentos-sidecar --test acp_adapter_stderr --test acp_extension --no-run
• cargo test -p agentos-client --test os_instructions_e2e --no-run

Preview publish:

• https://github.com/rivet-dev/agentos/actions/runs/28033945159 succeeded
• published preview version 0.0.0-codex-darwin-ci-publish.61a7af3
• confirmed npm optional deps include Darwin sidecar/plugin packages
• publish log placed plugin cdylibs for linux-x64-gnu, darwin-arm64, and darwin-x64

Notes

cargo fmt --check still reports unrelated pre-existing formatting churn in crates/client/tests/fs_e2e.rs and older formatting in touched Rust files; I left that out of scope to keep this diff focused.