The macOS package's declared minimum is never proved, the way the deb's was not

## The gap

The Linux side of this is fixed: the `.deb` now derives its glibc floor from the shipped binaries, and the glow-up matrix runs the package on ten releases and requires it to be refused below the floor.

macOS has the same shape of hole that #174 was on Linux, and nothing closes it.

- `crates/capsem-app/tauri.conf.json` declares `minimumSystemVersion`. It said `13.0` while both public `install.sh` copies refused anything below macOS 14 — the bundle advertised a release the installer denied. A Citadel guard now keeps those two agreeing with `config/gate.toml` `[platforms.macos]`.
- But agreeing is not the same as being *true*. Nothing checks that the binaries actually run on the declared minimum, or that they fail below it.

The macOS glow-up builds, signs and installs the real `.pkg` in a Tart VM and boots it through Apple Virtualization.framework — on `macos-14` only. That is exactly the position Linux was in: proved on one OS version, which happens to be the declared floor, so a wrong floor is invisible.

## Why it is harder than the Linux fix

The Linux proof is ten containers and takes about a minute. macOS needs a VM image per OS version, and Tart images for older macOS are heavier and slower than a `debian:12-slim` pull. There is no cheap equivalent of `ldd --version` plus `dpkg-deb --extract`.

## Options, cheapest first

1. **Static check.** Read `LC_BUILD_VERSION` / `LC_VERSION_MIN_MACOSX` out of the shipped Mach-O binaries with `otool -l` and require the minimum they were built against to equal the declared `minimumSystemVersion`. This is the direct analogue of `derive-deb-libc-floor.py` — it reads the floor out of the bytes instead of trusting a hand-written field — and costs nothing.
2. **Installer refusal.** Assert the `.pkg` itself refuses to install below the declared minimum, via its distribution XML `allowed-os-versions`, rather than relying on `install.sh` to check first. A user who downloads the `.pkg` directly never runs `install.sh`.
3. **A second Tart VM** at the declared floor. Real proof, real cost. Only worth it if 1 and 2 leave something unproved.

Option 1 alone would have caught the 13.0/14 drift from the binary side rather than by comparing two text files, and is the closest match to what the Linux side now does.

## Related

- #174 — the deb declared no libc floor at all (fixed)
- #181, #182 — Linux floor and musl packaging

Start with crates/capsem-app/tauri.conf.json and config/gate.toml’s [platforms.macos] entry, then read the existing derive-deb-libc-floor.py approach. Inspect the shipped Mach-O binaries and the macOS package metadata to determine which minimum-version checks are missing. Done means the declared floor is mechanically validated rather than only compared with installer text, with the relevant packaging check covered.

Written by the indexing model from the issue text.