build: add the macOS gate, darwin artifacts, and a Homebrew formula

CI runs fmt/clippy/test plus a real alpine boot on a macos-26 runner
with libkrun from the krun tap; the release workflow ships a signed
darwin-arm64 tarball beside the snaps. The formula installs from the
tap, carries the runtime kegs (libkrun, e2fsprogs, libarchive), and
codesigns the binary with the hypervisor entitlement — Hypervisor
.framework grants VM creation only to entitled binaries on current
macOS, the same requirement krunkit's formula signs for.

.github/workflows/ci.yml

@@ -38,6 +38,51 @@ jobs:
       - name: cargo test
         run: cargo test
 
+  macos:
+    name: macos — fmt, clippy, test, boot
+    runs-on: macos-26
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+
+      - uses: Swatinem/rust-cache@v2
+
+      # The engine is dlopen'd from the brew kegs at runtime; e2fsprogs
+      # supplies mke2fs and libarchive its tar path.
+      - name: Install the engine and the image tooling
+        run: brew install libkrun/homebrew-krun/libkrun e2fsprogs libarchive
+
+      - name: cargo fmt
+        run: cargo fmt --all -- --check
+
+      - name: cargo clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: cargo test
+        run: cargo test
+
+      - name: Build the CLI
+        run: cargo build --release -p ecrou-cli
+
+      # HVF grants VM creation only to binaries carrying the hypervisor
+      # entitlement on current macOS; packaging signs the same way.
+      - name: Sign the binary with the hypervisor entitlement
+        run: codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou
+
+      - name: Probe
+        run: ./target/release/ecrou probe
+
+      - name: Boot alpine
+        run: |
+          set -euo pipefail
+          guest="$(./target/release/ecrou run --quiet alpine -- uname -r | tail -n 1)"
+          echo "guest kernel: $guest"
+          test -n "$guest"
+
   t6:
     name: T6 strace audit
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -62,6 +62,45 @@ jobs:
           name: ${{ matrix.artifact }}
           path: ${{ steps.build.outputs.snap }}
 
+  # The macos distribution is a signed tarball, not a store release:
+  # brew taps install from it, and the entitlement signature rides in
+  # the artifact.
+  build-macos:
+    needs: gate
+    if: needs.gate.outputs.release == 'true'
+    runs-on: macos-26
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Stamp the tag version into the manifests
+        run: |
+          v="${GITHUB_REF_NAME#v}"
+          sed -i '' "s/^version = \".*\"/version = \"$v\"/" Cargo.toml
+          grep -H '^version' Cargo.toml
+
+      - name: Build the CLI
+        run: cargo build --release -p ecrou-cli
+
+      - name: Sign the binary with the hypervisor entitlement
+        run: codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou
+
+      - name: Package
+        run: |
+          v="${GITHUB_REF_NAME#v}"
+          tar -czf "ecrou-v$v-darwin-arm64.tar.gz" -C target/release ecrou
+          shasum -a 256 "ecrou-v$v-darwin-arm64.tar.gz" > "ecrou-v$v-darwin-arm64.tar.gz.sha256"
+          mkdir dist && mv ecrou-v$v-darwin-* dist/
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ecrou-darwin-arm64
+          path: dist/*
+
   publish-snap:
     needs: build-snap
     runs-on: ubuntu-latest