test: release smoke test on macOS CI runners

Feature Description

The v0.9.0 exit bar says install works cold on four targets. Nothing checks that today, so every
release risks shipping an installer that only worked on the author's laptop.

Proposed Solution

• CI job on macOS runners installing from a published tag exactly as a user would
  (curl | sh), not from a local build
• Assert the launchd service starts and abctl service status is healthy
• Drive a real request through the proxy and assert a parsed event with a non-zero token
  count, read through the unattended capture path (#955)
• Assert upgrade-over-existing and uninstall-is-clean
• Runs on every tag; a failure blocks the release
• Also runs against main-latest, so breakage is caught before tagging
• State which architectures CI covers and which stay manual

Additional Context

Part of the Cortex v0.9.0 release. Automates the macOS install verification (#944) and gates
exit criterion 1.