ci: macOS build smoke-test + flake darwin support

Add the two *-apple-darwin targets to rust-toolchain.toml and apple-sdk +
libiconv to the flake devShell (darwin only) so the nix toolchain links
AppKit; make cargo-zigbuild/zig Linux-only (macOS builds natively). Repoint
the throwaway macOS workflow to actually build both darwin targets through
the flake on the Tart runner — the first real check of the macOS leg, which
can't be verified locally. Delete once release-macos lands.

flake.nix

@@ -60,7 +60,15 @@
         packages.rdbms-playground = rdbms-playground;
 
         devShells.default = pkgs.mkShell {
-          inherit buildInputs;
+          buildInputs = buildInputs ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
+            # macOS release builds (aarch64/x86_64-apple-darwin) link AppKit
+            # (arboard) + libSystem; the nix toolchain's own clang resolves the
+            # frameworks via the Apple SDK provided here. (The Mac runner also
+            # has full Xcode, but the devShell stays self-contained.) `libiconv`
+            # is linked by several crates on darwin.
+            pkgs.apple-sdk
+            pkgs.libiconv
+          ];
           nativeBuildInputs = nativeBuildInputs ++ [
             rust
             # Dev-disk maintenance: cargo never garbage-collects stale per-hash
@@ -68,12 +76,12 @@
             # CLAUDE.md "Build hygiene"). cargo-sweep prunes them; run it
             # periodically between milestones.
             pkgs.cargo-sweep
-            # Cross-compilation for the D1 release matrix. `cargo zigbuild` uses
-            # Zig's bundled clang + libc as one universal cross cc/linker for
-            # every non-macOS target (Linux musl x64/arm64, Windows gnu/gnullvm
-            # x64/arm64) — including the `cc`-crate compile of rusqlite's bundled
-            # SQLite C — with no per-target toolchain or SDK. It auto-discovers
-            # `zig` on PATH, so no extra env is needed.
+          ] ++ pkgs.lib.optionals pkgs.stdenv.isLinux [
+            # Cross-compilation for the non-macOS D1 targets: `cargo zigbuild`
+            # uses Zig's bundled clang + libc as one universal cross cc/linker
+            # (incl. the `cc`-crate compile of rusqlite's bundled SQLite C) for
+            # Linux musl + Windows gnu/gnullvm. macOS builds natively with the
+            # Apple toolchain on the Mac runner, so these are Linux-only.
             pkgs.cargo-zigbuild
             pkgs.zig
           ];
@@ -82,7 +90,6 @@
             echo "RDBMS Playground dev shell ($(uname -s))"
             echo "  rust:   $(rustc --version | cut -d' ' -f1-2)"
             echo "  cargo:  $(cargo --version | cut -d' ' -f1-2)"
-            echo "  zig:    $(zig version 2>/dev/null || echo '?')  (cargo-zigbuild cross targets)"
           '';
         };
       });