macOS 27.0 (26A5xxx): SA payload injects but Dock offsets don't match — space ops broken; main-binary alias un-breaks window mgmt

## Summary

On **macOS 27.0** beta, `yabai --load-sa` fails (`attrib != ALL`) and scripting-addition space operations are no-ops. macOS 27 is not in the supported-version list, so `version.majorVersion == 27` matches none of the `workspace_is_macos_*()` predicates and the injected payload's `verify_os_version()` returns `false`.

Aliasing `majorVersion >= 27` → `26` at the two version-detection sites gets the payload to **inject and run** and restores **Accessibility-based window management** (focus/swap/resize/tiling) — but it is **not sufficient for the scripting addition's Dock functions**: the Tahoe(26) offsets/patterns only partially match macOS 27's Dock, so `dock.spaces`/`add_space`/etc. don't all resolve and space ops stay broken. Posting this as a tracking/starting point for proper macOS 27 support.

## Environment

- macOS **27.0**, build **26A5353q** (Apple M4 Pro, arm64e)
- yabai `HEAD` @ `2d743f4` (reports v7.1.25), `brew install --HEAD asmvik/formulae/yabai`
- SIP: Filesystem Protections + Debugging Restrictions + NVRAM disabled; `nvram boot-args=-arm64e_preview_abi` set; Accessibility granted

## Root cause

`src/workspace.h` caps known versions at Tahoe = 26, and `src/workspace.m` matches exactly:

```c
_workspace_is_macos_version_##name = version.majorVersion == major_version;
```

So on `majorVersion == 27`, every `workspace_is_macos_*()` returns `false` → the main binary uses legacy code paths, and `src/osax/payload.m::verify_os_version()` (cases 11–15, 26 only) returns `false` → `init_instances()` bails, nothing is hooked.

## Partial fix (gets injection + window management; NOT space ops)

```diff
--- a/src/workspace.m
+++ b/src/workspace.m
@@ bool workspace_event_handler_begin(void **context)
NSOperatingSystemVersion version = [[NSProcessInfo processInfo] operatingSystemVersion];
+ if (version.majorVersion >= 27) version.majorVersion = 26; // alias macOS 27+ to Tahoe(26)
#define SUPPORT_MACOS_VERSION(name, major_version) _workspace_is_macos_version_##name = version.majorVersion == major_version;
```

```diff
--- a/src/osax/payload.m
+++ b/src/osax/payload.m
@@ static void init_instances()
NSOperatingSystemVersion os_version = [[NSProcessInfo processInfo] operatingSystemVersion];
+ if (os_version.majorVersion >= 27) os_version.majorVersion = 26; // reuse Tahoe Dock offsets/patterns
if (!verify_os_version(os_version)) return;
```

Branch / diff:
- https://github.com/anyrobert/yabai/tree/fix/macos-27-sa-support
- compare: https://github.com/asmvik/yabai/compare/master...anyrobert:yabai:fix/macos-27-sa-support

## What I actually verified on 26A5353q (M4 Pro)

- ✅ Payload **injects and runs** in Dock (Dock holds the `/tmp/yabai-sa_.socket` listener).
- ✅ Accessibility-based **window management** works (focus / swap / resize / tiling) once the main-binary alias is applied.
- ❌ **Scripting-addition space ops do NOT work**: `space --create/--destroy/--move`, window-to-space are no-ops; `--load-sa` returns 1 with `attrib != OSAX_ATTRIB_ALL`.

So the **Dock memory offsets/patterns for macOS 27 differ from Tahoe** — `arm64_payload.m`'s `get_*_offset()/get_*_pattern()` need dedicated `majorVersion == 27` cases derived from the macOS 27 Dock binary. The alias above is only a foundation (un-breaks the main binary + gets the payload running); it is **not** a complete SA fix.

## Note when testing

`OSAX_VERSION` unchanged → after rebuilding, force the on-disk payload to be replaced or the old one reloads: `sudo yabai --uninstall-sa && sudo yabai --load-sa` (or bump `OSAX_VERSION`).

## Asks for the maintainer

- Add `majorVersion == 27` handling (alias or, ideally, real offsets) so the main binary stops falling back to legacy paths on 27.
- Dedicated macOS 27 Dock `get_*_offset()/get_*_pattern()` values are needed for space functionality. Happy to help test on 26A5353q.

---
_{🤖 Investigated with [Claude Code](https://claude.com/claude-code).}

Start with version handling in src/workspace.h, src/workspace.m, and src/osax/payload.m, then inspect the get_*_offset()/get_*_pattern() functions in arm64_payload.m for the Dock. Use the reported macOS 27 build and force a fresh payload with sudo yabai --uninstall-sa && sudo yabai --load-sa. Done means the payload loads successfully and space operations such as create, destroy, move, and window-to-space work on macOS 27.

Written by the indexing model from the issue text.