feat(macos): add Intel (x86_64) build with separate DMG

[jguice]

Summary

• Adds a separate macos-intel-build job that produces utter-VERSION-macos-x86_64.dmg for Intel Macs.
• Silicon path is bit-for-bit unchanged — same macos-14 runner, same prebuilt ONNX Runtime download, same arm64 DMG. The new job runs in parallel and the release glob (dist/utter-*-macos-*.dmg) already picks up both.
• README adds a brief ### macOS (Intel) section after Apple Silicon; existing silicon section + heading + anchor untouched.

Why this shape (vs. universal binary, vs. load-dynamic)

Pyke ort 2.0.0-rc.12 doesn't ship prebuilt ONNX Runtime for x86_64-apple-darwin. We considered:

1. Universal binary (one DMG, both arches lipo'd) — would have inflated the silicon DMG ~3× because the universal binary carries both static-linked slices. Penalizes silicon users (the majority) for Intel support.
2. ort load-dynamic + bundled universal2 dylib — symmetric across arches but inflates the silicon DMG from ~9.5 MB to ~70-80 MB.
3. From-source ONNX Runtime + separate Intel DMG ← this PR. Silicon DMG unchanged; Intel users download a separate ~10-15 MB DMG. Confines all build-system complexity to the Intel job.

How it works

• New macos-intel-build job runs on macos-14-large (native Intel).
• Clones microsoft/onnxruntime at v1.24.2 (matches what pykeio/ort's custom-static-link.yml validates against), runs their build.sh with --skip_tests to trim ~30% off cold-build time. Output is the multi-file static .a set ort-sys's static_link/mod.rs knows how to consume.
• Caches the build dir keyed on ONNXRUNTIME_VERSION — heavy build only re-runs when we bump the pin.
• cargo build --release --target x86_64-apple-darwin with ORT_LIB_PATH pointing at the build dir → ort-sys static-links the local libs instead of trying (and failing) to download a prebuilt.
• Bundle / sign / notarize / DMG / staple — same machinery as silicon, just with the x86_64 binary and the -macos-x86_64.dmg name.

Local validation

End-to-end on an Intel Mac:

• ✅ ONNX Runtime v1.24.2 builds cleanly from source (~30 min cold)
• ✅ ort-sys's static-link probes find what onnxruntime's CMake produced — no patches needed
• ✅ cargo build produces a 21 MB x86_64 Mach-O
• ✅ make-bundle.sh + Apple Development cert → stable-signed .app
• ✅ Launches, all 3 TCC prompts surface and grants persist
• ✅ Model downloaded, PTT dictation transcribes successfully

Caveats / known unknowns

• CI cross-runner equivalence not yet verified. Local POC was a native Intel Mac with brew-installed cmake; CI uses macos-14-large which is also native Intel but reportedly slow. First CI release run is the real test.
• Cold build time on the slow Intel runner could be 60-90 min on first run; cached runs are instant. --skip_tests mitigates.
• Future runner deprecation: macos-14-large will sunset alongside macos-14 per actions/runner-images#13518. Both macOS jobs will need to migrate to macos-15-intel / macos-15 together — kept aligned here intentionally.

Test plan

• Trigger gh workflow run release.yml -f tag=v0.3.0 --ref feat/macos-universal-binary and confirm:
  • Silicon job (macos-build) succeeds with no behavior change
  • Intel job (macos-intel-build) succeeds: ONNX Runtime build → cargo build → bundle → notarize → DMG → notarize DMG
  • dist/ contains both utter-0.3.0-macos-arm64.dmg and utter-0.3.0-macos-x86_64.dmg
• Install Intel DMG on an Intel Mac (macOS 13+) → confirm launch, permissions, dictation
• Install arm64 DMG on Apple Silicon → confirm no regression

🤖 Generated with Claude Code