Fix doryd execution admission in signed releases

[Augani]

Root cause

macOS 27 killed the notarized doryd helper before main with OS_REASON_EXEC because the renderer release identity was encoded as a custom signed entitlement. Codesign and notarization accepted the file, but launch-time execution policy did not.

Fix

• embed the immutable runner/renderer CDHash tuple in a signed __TEXT,__doryid Mach-O section
• keep doryd entitlement-free and verify its Developer ID signature plus exact embedded payload
• rebuild doryd only after the nested runner graph receives its final signatures
• add fail-closed Mach-O parsing, canonical payload tests, and release-order checks
• update physical release smoke checks to use the nested DoryHVRunner executable path

Verification

• full Swift suite: 447 tests in 50 suites passed, with all XCTest suites passing
• renderer identity Python suite: 9 passed
• live-smoke contract suite: 6 passed
• component packaging contract: passed
• release workflow contract: passed
• Developer ID signed arm64 doryd: exact section verified, no entitlements, reached main under macOS execution policy instead of OS_REASON_EXEC