ci: drop nix libiconv from darwin build (portable macOS binary)

The smoke-test caught the aarch64 binary linking a /nix/store libiconv.dylib
— non-portable (won't exist on a user's Mac). The Apple SDK already provides
a system libiconv stub, so removing pkgs.libiconv makes the linker resolve
-liconv to /usr/lib instead. The smoke-test now fails if any /nix/store dylib
is linked.

flake.nix

@@ -62,12 +62,13 @@
         devShells.default = pkgs.mkShell {
           buildInputs = buildInputs ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
             # macOS release builds (aarch64/x86_64-apple-darwin) link AppKit
-            # (arboard) + libSystem; the nix toolchain's own clang resolves the
-            # frameworks via the Apple SDK provided here. (The Mac runner also
-            # has full Xcode, but the devShell stays self-contained.) `libiconv`
-            # is linked by several crates on darwin.
+            # (arboard) + libSystem; the Apple SDK provides those framework/
+            # system-lib stubs as *system* paths (/usr/lib, /System/Library), so
+            # the resulting binary is portable. NOTE: do NOT add `pkgs.libiconv`
+            # — it makes the linker prefer the nix-store libiconv.dylib, baking a
+            # /nix/store path into the binary (non-portable). The SDK's own
+            # libiconv stub resolves `-liconv` to /usr/lib/libiconv instead.
             pkgs.apple-sdk
-            pkgs.libiconv
           ];
           nativeBuildInputs = nativeBuildInputs ++ [
             rust