[codex] Scope macOS signing secrets to release environment

[jweate-openai]

Summary

• Split macOS Rust release builds into a dedicated build-macos job
• Attach the macos-signing environment only to the macOS signing/build job
• Keep Linux release builds outside the Apple signing environment while preserving shared release build steps

Validation

• Applied the provided patch locally and verified the workflow parses as YAML
• actionlint on the exact patch reports the existing matrix.runs_on || matrix.runner expression pattern in rust-release.yml; I did not include an extra cleanup commit so this branch matches the provided diff