Add macOS voice runtime projection (#42204)

## What changed

- Add a shared runtime preparer that validates native build receipts, source and
  file digests, dependency closure, and output containment before copying the
  required voice plugins and libraries.
- Add macOS-specific Mach-O inspection and relocation that removes build-time
  runpaths, rewrites non-system dependencies relative to each loader, applies
  development ad-hoc signatures, and records the resulting payload in
  `runtime.json`.
- Close the state runtime explicitly in the clear-memories CLI test.

## Testing

- Add macOS tests covering relocation after the source prefix is removed and
  fail-closed handling of invalid receipts, changed inputs, unsafe paths,
  dependency conflicts, malformed Mach-O metadata, and failed transforms.

GitOrigin-RevId: 3be7a6fabf0135a57036cbb0a9a3e597096930fd

codex-rs/cli/tests/debug_clear_memories.rs

@@ -17,7 +17,7 @@ async fn debug_clear_memories_resets_state_and_removes_memory_dir() -> Result<()
     let codex_home = TempDir::new()?;
     let sqlite = codex_state::SqliteConfig::new_for_testing(codex_home.path().abs());
     let runtime = StateRuntime::init(sqlite.clone(), "test-provider".to_string()).await?;
-    drop(runtime);
+    runtime.close().await;
 
     let thread_id = "00000000-0000-0000-0000-000000000123";
     let db_path = sqlite.state_db_path();