feat(app): make the darwin podman-machine check real and provisioning-aware (RIG-3202)

[rigel-mintaka]

This PR is part of a stack containing 2 PRs:

1. main
2. feat(stack): read the process identity token via sysctl on darwin (RIG-3548) #1033
3. "feat(app): make the darwin podman-machine check real and provisioning-aware (RIG-3202)" (this PR)

Embedded preflight guarded the podman-machine check with
GOOS == "darwin" && MachineReady != nil, and realPreflight never
assigned MachineReady. So on a Mac the check did not fail — it VANISHED
from the results, and a caller classifying by result read that as a pass.
A user got an all-green preflight followed by an undiagnosed failure
further down.

Wire a real darwin adapter and close the hole that let it be skipped:

• The darwin branch keys on GOOS alone. A nil adapter is now reported as a
  failed check naming itself a wiring defect, so a wiring regression can
  no longer turn a broken host into a green preflight. Linux behaviour is
  unchanged (no machine there, check correctly absent).
• The adapter probes machine ls then machine inspect, and CONNECTS to
  the forwarded API socket rather than stat-ing it, since a stale forward
  from a half-stopped machine satisfies a stat. Three failing states are
  distinguished in the copy — no machine, stopped, running with an
  unreachable socket — each naming the command to run.
• Provisioning is an ensure step (init/start, then RE-PROBE), mirroring how
  up ensures the image and database rather than gating on them. Readiness
  comes from the re-probe, never from init's exit status. An unclassifiable
  CLI answer provisions nothing: init over a machine whose state cannot be
  read is destructive.
• Unparseable output classifies as unknown, which is never ready.
  machineStatus's zero value is unknown so a failed classification cannot
  read as ready.
• The bring-up window now budgets for a cold provision on darwin. A cold
  machine init downloads a VM image before any container image is pulled,
  so the previous 180s ceiling would have deadlined every first launch on
  a fresh Mac and blamed the timeout rather than the download.

The OS is a parameter rather than a build tag, so the exact regression this
closes is testable from a linux host.

The macOS spike has NOT run. Every podman-CLI output shape here is
designed-against-assumption per the record's own convention: the parse
accepts both the Running bool and the State string, and degrades rather
than trusting either. macOS provisioning is not claimed to work.

Refs RIG-3202, RIG-1662.

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-3202

RIG-1662

[github-actions]

Compass engineering docs preview: https://compass-native-rig-3202-darw.compass-eng-docs.pages.dev

Deployed from compass-native/rig-3202-darwin-machine-ready at d924557.