[codex] fix macos cli release proof

[TheGreenCedar]

Summary

• keep Developer ID, hardened runtime, timestamp, team identity, and Apple notarytool Accepted checks fail-closed
• retain spctl as a diagnostic for bare Mach-O executables instead of requiring application-bundle acceptance
• gate both release-time and post-publish proof on the same quarantined CLI executing --version and --help
• structurally bind quarantine write/read, diagnostic, and execution to the same path

Verification

• node --test .github/scripts/check-workflow-policy.test.mjs
• node .github/scripts/check-workflow-policy.mjs
• actionlint .github/workflows/packaged-platform-proof.yml .github/workflows/post-publish-release-smoke.yml .github/workflows/release.yml
• node .github/scripts/check-doc-links.mjs
• git diff --check
• independent blocker-only review approved the exact diff

No Rust or product-runtime code changed. Automation is net -4 lines; the net growth is the structural policy boundary, one focused mutation test, and release documentation.

Closes #1144
Refs #1046