ci: macOS build smoke-test + flake darwin support

Add the two *-apple-darwin targets to rust-toolchain.toml and apple-sdk +
libiconv to the flake devShell (darwin only) so the nix toolchain links
AppKit; make cargo-zigbuild/zig Linux-only (macOS builds natively). Repoint
the throwaway macOS workflow to actually build both darwin targets through
the flake on the Tart runner — the first real check of the macOS leg, which
can't be verified locally. Delete once release-macos lands.

.gitea/workflows/macos-probe.yaml

@@ -1,49 +1,39 @@
-# THROWAWAY DIAGNOSTIC for the macOS (Tart) runner — delete once the macOS
-# release leg is wired.
+# THROWAWAY build smoke-test for the macOS (Tart) runner. Verifies both
+# *-apple-darwin targets actually compile and link (incl. arboard's AppKit)
+# through the flake on the real Mac, before the full release-macos workflow is
+# wired. Delete once that lands.
 #
-# Trigger: runs on a push that touches THIS file. workflow_dispatch is kept too,
-# but Gitea only exposes manual dispatch for workflows on the DEFAULT branch
-# (main) — and all our CI is still on `ci` — so push is how we drive it for now.
-# Bring the Mac up before pushing a change here so the run isn't left queued.
-#
-# Answers: does the `macos:host` runner pick up jobs, does it run on the host,
-# what arch + macOS version, is the Xcode SDK present (needed to link arboard's
-# AppKit), and which build toolchain is available (nix? rustup? bare cargo?) —
-# plus git/node for actions/checkout.
-name: macos-probe
+# Push-triggered (workflow_dispatch only works for workflows on the default
+# branch; our CI is on `ci`). Runs when the flake/toolchain or this file change.
+# Bring the Mac up before pushing so the run isn't left queued.
+name: macos-build-test
 on:
   push:
     paths:
       - '.gitea/workflows/macos-probe.yaml'
+      - 'flake.nix'
+      - 'rust-toolchain.toml'
   workflow_dispatch:
 
 jobs:
-  probe:
-    # Label NAME only. The runner was registered as `macos:host`, but `:host` is
-    # act_runner's execution-backend schema (run on the host, no container), not
-    # part of the label — so the label is just `macos`.
+  build:
+    # Label NAME only — `:host` in the runner registration is the execution
+    # backend (run on host), not part of the label.
     runs-on: macos
+    env:
+      # Guarantee flakes regardless of the Mac's nix config.
+      NIX_CONFIG: "experimental-features = nix-command flakes"
     steps:
-      - name: identity, SDK, toolchains
+      - uses: actions/checkout@v4
+      - name: build both darwin targets through the flake
         run: |
-          echo "=== uname ==="; uname -a; echo "arch: $(uname -m)"
-          echo "=== macOS version ==="; sw_vers 2>&1 || echo "(sw_vers?)"
-          echo "=== host or container? ==="
-          if [ -f /.dockerenv ]; then echo "/.dockerenv PRESENT -> container"; else echo "host (no /.dockerenv)"; fi
-          echo "=== identity ==="; whoami; id
-          echo ""
-          echo "=== Xcode CLT / SDK (needed to link AppKit) ==="
-          xcode-select -p 2>&1 || echo "(no CLT)"
-          xcrun --show-sdk-path 2>&1 || echo "(no sdk)"
-          clang --version 2>&1 | head -1 || echo "(no clang)"
-          echo ""
-          echo "=== build toolchains on PATH ==="
-          echo "nix:    $(command -v nix    || echo NO)"
-          echo "rustup: $(command -v rustup || echo NO)"
-          echo "cargo:  $(command -v cargo  || echo NO)"
-          echo "rustc:  $(command -v rustc  || echo NO)"
-          rustc --version 2>/dev/null || true
-          echo ""
-          echo "=== git / node (for actions/checkout) ==="
-          echo "git:  $(command -v git  || echo NO)  $(git --version 2>/dev/null)"
-          echo "node: $(command -v node || echo NO)  $(node --version 2>/dev/null)"
+          set -e
+          for t in aarch64-apple-darwin x86_64-apple-darwin; do
+            echo "==================== $t ===================="
+            nix develop -c cargo build --release --target "$t"
+            f="target/$t/release/rdbms-playground"
+            file "$f"
+            echo "--- linked libs (otool -L) ---"
+            otool -L "$f" 2>/dev/null | head -8 || true
+          done
+          echo "=== both darwin targets built ==="