fix(ci): move macOS builds off macos-14

[dmeijboom]

Summary

• Move x86_64-darwin builds to macos-15-intel and aarch64-darwin builds to macos-15 in both build and release workflows.
• Run the build matrix on pull requests so both macOS architectures are validated before merging.
• Preserve all five artifact names, Nix package targets, packaging steps, and the release-only publication trigger.

GitHub is retiring macos-14 on November 2. The runner reference identifies macos-15-intel as Intel and macos-15 as arm64. Matching native hosts matters because the Darwin packages in flake.nix use localSystem, without Darwin cross-compilation.

Validation

• Passed local YAML parsing and assertions for both native Darwin runner mappings, five-platform matrix parity, unchanged Nix build commands, read-only build permissions, and release-only publication.
• All five native/cross-platform build jobs passed for commit 6ccd41277b97fe0d9c402f0e6f83c89f28e6b874: Intel macOS, ARM macOS, amd64 Linux, ARM Linux, and Windows cross-build. Packaging and artifact uploads passed for all five.
• Flake check passed.
• Release publication was not triggered; its build job is identical to the validated build matrix.

This is intentionally separate from #13's release-version changes.