Support CGO_ENABLED=1 darwin cross-compilation for bridged providers

[pose]

Motivation

Bridged providers cross-compile darwin binaries from Linux with CGO_ENABLED=0. When an upstream provider (directly or transitively) imports a package whose darwin code path requires CGO, the cross-build cannot resolve the C symbols and fails. Recent case: pulumi/pulumi-docker#1698, where docker/compose/v2's FSEvents-backed file watcher (github.com/fsnotify/fsevents) requires CGO on darwin. The current mitigation is a per-repo patch that deletes the offending resource (pulumi/pulumi-docker#1704), tracked for removal in pulumi/pulumi-docker.

Patching around each occurrence works only when the offending code is a deletable leaf. @corymhall raised the concern (pulumi/pulumi-docker#1704 review) that we may eventually hit a case where the CGO-requiring import is load-bearing and cannot be patched out, leaving us with no path to ship that provider for darwin.

Ask

Evaluate adding an opt-in path to cross-compile darwin provider binaries with CGO_ENABLED=1 (e.g. via osxcross / a cross C toolchain in the build image, or native macOS runners for the darwin legs). This would be a durable fallback for the "darwin import needs CGO" failure class, independent of whether each specific dependency can be patched.

Scope notes

• This is the build-capability side. PR-time detection of this failure class is tracked separately in Add darwin cross-builds to bridged-provider PR check matrix #2233 (add darwin legs to the bridged-provider PR check matrix).
• Likely involved (toolchain image size, signing/notarization on native runners, CI minutes), so this is a tracking/scoping issue rather than a committed deliverable.

Related

• Add darwin cross-builds to bridged-provider PR check matrix #2233 — add darwin to the PR-time build_provider matrix
• Workflow failure: master pulumi-docker#1698 — master break that motivated this
• Remove docker_compose resource via upstream patch pulumi-docker#1704 — interim per-repo patch