chore(build): remove bundled Z3 support

[SDAChess]

Summary

Remove the unused bundled-z3 feature and its remaining build, test, and documentation references. Builds now use toolchain-provided Z3 on Linux and macOS and the existing prebuilt Z3 path on Windows.

Related Issue

No issue required: mechanical build cleanup removing an unused feature and orphaned build infrastructure.

Changes

• Remove bundled-z3 feature forwarding from the prover, server, and gateway crates.
• Remove the Z3 source-build dependency chain from Cargo.lock.
• Update build and E2E paths to use toolchain-provided Z3.
• Remove obsolete bundled-Z3 CMake cache cleanup.
• Remove the unused osxcross macOS Dockerfiles and their Trivy exclusion.
• Update build, contributor, compute-driver, and Windows documentation.

Testing

• mise run pre-commit passes
  • Could not start because local mise bootstrapping attempted to build Python without a C compiler.
• Existing prover unit tests pass (27 passed)
• Unit tests added/updated
• E2E tests added/updated (not applicable)
• cargo check --locked --offline -p openshell-gateway
• Cargo lockfile checks
• ShellCheck
• Markdownlint
• Agent infrastructure consistency audit
• No bundled-z3, z3/bundled, or z3-src references remain

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3275.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for ba19bea. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[github-actions]

Label test:e2e-kubernetes applied for ba19bea. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute Kubernetes HA and credential-driver E2E after building the required gateway and supervisor images once. This is an optional proof-of-life suite; failures are visible in the workflow run but do not publish a required CI gate status.

[github-actions]

Label test:e2e-gpu applied for ba19bea. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute GPU E2E after building the required supervisor image once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[elezar]

Thanks @SDAChess. Looks OK from my side, but it may be good to get @pimlock or @drew to weigh in here too.