test: release smoke test on macOS CI runners

[huang195]

Feature Description

The v0.9.0 exit bar says install works cold on four targets. Nothing checks that today, so every
release risks shipping an installer that only worked on the author's laptop.

Proposed Solution

• CI job on macOS runners installing from a published tag exactly as a user would
  (curl | sh), not from a local build
• Assert the launchd service starts and abctl service status is healthy
• Set ABCTL_LAUNCHD_TESTS=required on this job so TestWaitBootedOut_RealLaunchd
  (cmd_service_bootout_test.go) actually runs instead of silently skipping — true in
  every CI run today, since no workflow sets the var. Mirrors ABCTL_SYSTEMD_TESTS=required
  on the Linux side (Test: Real-systemd integration test for crash recovery, wired into CI #1076), which turns the same class of skip into a hard failure.
• Drive a real request through the proxy and assert a parsed event with a non-zero token
  count, read through the unattended capture path (feature: support unattended agent workloads — headless agent runs with no human present #955)
• Assert upgrade-over-existing and uninstall-is-clean
• Runs on every tag; a failure blocks the release
• Also runs against main-latest, so breakage is caught before tagging
• State which architectures CI covers and which stay manual

Additional Context

Part of the Cortex v0.9.0 release. Automates the macOS install verification (#944) and gates
exit criterion 1.