ci: add macOS matrix coverage on main pushes

[gregmagolan]

Adds macOS coverage to the preset CI matrix so Apple-Silicon-only breakage can't slip through a green Linux build — the way the gcr.io/distroless/base linux/arm64/v8 manifest bug (#900) did, breaking aspect build //... for Go projects on Macs while CI stayed green.

macOS runners are billed at 10x Linux on GHA, so the os dimension expands to [ubuntu-latest, macos-latest] only on main pushes and stays [ubuntu-latest] on PRs. PR cost is unchanged; only post-merge runs pay for the macOS legs.

Standing up the macOS legs surfaced three real, latent issues this matrix now guards against — two are genuine template fixes that also help anyone building locally on Apple Silicon:

1. GitHub API rate-limit (CI). On a cold macOS cache all presets stampede the unauthenticated GitHub releases API the aspect-launcher/bazelisk use (60 req/hr per IP) → 403. Fixed by authenticating those calls with the job token (GH_TOKEN/GITHUB_TOKEN/BAZELISK_GITHUB_TOKEN) + contents: read.
2. LLVM too old for the macOS 15 SDK (template). The hermetic toolchain pinned LLVM 15, whose clang can't parse the macOS 15.5 SDK's libc++ (unknown type name '__remove_cv'). Bumped to LLVM 19.1.7 (single entry — 19.1.7 ships linux-x64 + darwin-arm64 + darwin-x64).
3. rules_cc target rename (template). toolchains_llvm 1.8.0's generated cc_toolchain selects on //cc/toolchains/args/archiver_flags:use_libtool_on_macos_setting, which rules_cc 0.2.19 renamed away. Pinned rules_cc to 0.2.18 (newest with the target) and widened its gate from cpp to cpp or (rust and lint) to match where the LLVM toolchain is registered.

Two follow-ups, both scoped out deliberately:

• clang-tidy lint is skipped on macOS for cpp/kitchen-sink. This is an unfixed upstream bug — rules_lint's _update_flag strips absolute -isystem libc++ paths as MSVC /flags (rules_lint#924, open PR #779). Build/test/format still run on macOS for cpp. Re-enable once that ships.
• Per-task GitHub status comments/checks disabled (--github-status-comments:enabled=false --github-status-checks:enabled=false) on all task calls — ~7 tasks × 12 presets × 2 OSes was tripping the App-installation API limit. The GHA check is the source of truth for the matrix.

The actionlint download step is now uname-derived (OS + arch) so it works on the macOS arm64 runners.

Scope note: this only touches the template repo's own validation CI (.github/workflows/ci.yaml). The stamped CI shipped into generated projects (template/.github/workflows/ci.yaml) is unchanged — macOS billing there is the user's call. (The LLVM/rules_cc bumps in #2/#3 are in the shipped template/MODULE.bazel, since they fix real local builds for users.)

---

Changes are visible to end-users: yes

• Searched for relevant documentation and updated as needed: yes

• Breaking change (forces users to change their own code or config): no

• Suggested release notes appear below: yes

• Fixed the hermetic C++ toolchain on Apple Silicon / macOS 15 SDK: bumped LLVM 15 → 19.1.7 and pinned rules_cc to 0.2.18, so aspect build //... works locally for cpp and rust+lint projects on Macs (previously failed with unknown type name '__remove_cv' / missing use_libtool_on_macos_setting).

Test plan

• Manual testing; please provide instructions so we can reproduce:
  • Verified on macOS 15.5 SDK (Apple Silicon): cpp builds + 2/2 tests pass, rust builds (incl. the C++-backed formatter that previously failed).
  • Full macOS matrix proven green (12/12 presets) on a temporary forced-on run; the gated os: expression keeps PRs ubuntu-only and was confirmed to produce 0 macOS / 12 ubuntu legs on this PR.