[codex] simplify macOS packaged proof

[TheGreenCedar]

Context

Closes #1057
Refs #1046

The macOS package gate had accumulated a large synthetic harness and several overlapping checks around the same supported lifecycle. The real release contract is narrower: package execution on both Mac architectures, managed Metal cold/warm/recovery on Apple Silicon, explicit Intel CPU/external labeling, dead-endpoint blocking, exact process reuse, and proof-owned cleanup.

Outcome

Keep those release boundaries while removing speculative edge-case variants and duplicate surface checks from every packaged proof run.

What changed

• Removed the fake CLI matrix and redundant synthetic cleanup variants from the packaged proof self-test while retaining direct coverage of ownership validation and registered cleanup.
• Removed duplicate doctor/context/status retries and the speculative corrupt model/native-server hardware variants; packet, search, readiness, recovery, process identity, and cleanup proof remain.
• Updated the workflow policy, protected Mac workflow, contributor testing contract, and changelog to match the smaller proof surface.

The final diff is 178 additions and 1,036 deletions: net -858 lines.

How to review

1. Start with .github/scripts/check-packaged-agent-proof.py; confirm each retained assertion protects a supported lifecycle or cleanup boundary.
2. Check .github/workflows/macos-metal-proof.yml and the policy script together; the protected lifecycle still runs from the packaged arm64 artifact.
3. Compare docs/contributors/testing-matrix.md with the workflow to confirm removed claims are no longer documented.

Verification

• node .github/scripts/check-workflow-policy.mjs — passed on c46aaf5.
• actionlint .github/workflows/macos-metal-proof.yml .github/workflows/packaged-platform-proof.yml .github/workflows/packaged-platform-pr.yml .github/workflows/release.yml — passed.
• git diff --check origin/dev/codestory-next...HEAD — passed.
• The accepted cleanup was rebased onto dev/codestory-next at 8422181; no pre-squash [codex] prove grounding-only managed plugin convergence #1058 implementation commits were replayed.

Risk or follow-up

• This is verification cleanup only; production runtime behavior is unchanged.
• Platform, protected hardware, signing, and notarization were intentionally not rerun for this deletion-focused PR.