Add native Apple Silicon macOS build support

[poitee]

Summary

• Add scripts/macos/build-local.sh for native Intel and Apple Silicon builds using Homebrew Qt
• Update macOS CI scripts to detect architecture, use Homebrew Qt on arm64, and compile mc-agent/mc-cli from source instead of bundling Intel-only binaries
• Add GitHub Actions workflow for macOS builds on macos-14
• Document the build process in documentation/macos_apple_silicon.md

Motivation

Official release DMGs are x86_64 only. On Apple Silicon Macs, Moolticute currently requires Rosetta (#1254, #929).

Test plan

• ./scripts/macos/build-local.sh on Apple Silicon (arm64) — produces native binary
• ./scripts/macos/build-local.sh --package bundles arm64 mc-agent and mc-cli
• ./build/tests/tests — 23 tests passed
• Maintainer verification with Mini BLE over USB on Apple Silicon hardware

Made with Cursor

[poitee]

I testing via real hardware, it compiles and seems to work. Hope this helps.

[hyperbotsx]

I've hardware-validated this PR's approach on an Apple Silicon Mac (macOS 26.5.2) with a Mooltipass Mini BLE, and contributed a set of hardening commits plus one critical fix on top of it: poitee#1

Headline results:

• The pipeline approach works — GitHub Actions macos-14 (arm64) runners build a fully native bundle (GUI, daemon, mc-agent, mc-cli all arm64), 63/63 unit tests pass in CI.
• Testing on real hardware caught a showstopper that affects every native arm64 build of master, independent of this PR: the daemon crash-loops (EXC_BREAKPOINT in FilesCache::setCardCPZ) the moment a card CPZ is read — an undefined 32-bit shift in the SimpleCrypt key derivation that x86 tolerated and arm64 compiles into a trap. Fixed with byte-identical key derivation (details + binary-level evidence in the linked PR). After the fix, the full USB feature matrix passes on my device: detection, unlock, credential read/write, browser extension, mc-cli, notes, settings, replug recovery.
• BLE testing is still pending on my side (device battery died mid-session) — will follow up with results.
• Two more findings worth knowing: the auto-updater offers the Intel v1.04.0 DMG to native builds (accepting the "update" would reinstall the Rosetta dependency), and upgrading over an Intel install can leave a stale shared-memory daemon record that blocks the new daemon (documented a workaround in the docs).

Thanks @poitee for the excellent base — hopefully the extra validation helps get this merged.

[limpkin]

@raoulh could you give it a look? i'm not proficient enough in this...