ci(binaries): build the macOS Intel asset on an Intel runner and assert binary architecture

[lab700xdev]

Problem

The aisbom-macos-amd64 release asset is an arm64 binary. The leg ran on macos-14 (Apple Silicon) with architecture: x64 requested from setup-python, but PyInstaller builds for the interpreter actually running it and produced arm64. The published v1.5.0 and v1.3.3 assets both report Mach-O 64-bit executable arm64 under file and lipo -archs.

The existing smoke test couldn't catch this because it executes the binary on the runner that built it, where an arm64 build runs natively.

Change

• The Intel leg builds on macos-15-intel, so the binary is x86_64 and the smoke test really executes it on Intel.
• New Assert binary architecture step, before the smoke test, on all three legs: reads the architecture from the executable (lipo -archs on macOS, file on Linux) and fails the job if it doesn't exactly match the leg's expected_arch. A mismatched build fails the release instead of being uploaded.
• Jobs are named by asset (Build aisbom-macos-amd64) instead of runner, so the two macOS legs no longer share a name and their logs can be told apart.

Verification

This workflow only runs on release: published, so I ran the full matrix on a temporary branch with a temporary push: trigger and relaxed tag gates. That scaffolding is not in this PR, and the branch is deleted. Upload Release Asset stayed guarded by refs/tags/ and was skipped in both runs.

• Run A (old runner, new assertion): the amd64 leg went back on macos-14. It failed as intended at the new step with FAIL: aisbom-macos-amd64 is 'arm64', expected 'x86_64'.
• Run B (this PR's workflow): all four jobs green. Assertion output:
  • aisbom-linux-amd64: ELF 64-bit LSB executable, x86-64
  • aisbom-macos-amd64: runner Darwin x86_64, Mach-O 64-bit executable x86_64
  • aisbom-macos-arm64: runner Darwin arm64, Mach-O 64-bit executable arm64
• The exit-code and SBOM smoke test passed on all three legs.
• I downloaded Run B's built binaries and checked them locally. lipo -archs gave x86_64 for the Intel asset and arm64 for the ARM asset. The Intel binary's minimum macOS version is 10.13 (LC_VERSION_MIN_MACOSX), and the arm64 one is unchanged at 11.0.