Phase 2: add path-filtered polyglot CI and published-artifact end-to-end tests

[solomonneas]

Parent: #352

Phase: 2

Add fast path-filtered Python, Rust, and Go jobs plus one matrix that tests published artifacts rather than workspace binaries.

Acceptance criteria:

• Python-only changes do not rebuild unrelated engines unless shared schemas or release files changed.
• Rust and Go jobs retain their standalone verification commands.
• The published-artifact matrix covers supported Linux, macOS, and Windows targets.
• Every manifest binary runs by absolute managed path.
• Missing assets, digest mismatches, and accidental PATH resolution fail the job.
• GitHub-hosted runners are the only release gates.

[solomonneas]

macOS coverage for this matrix, using GitHub-hosted runners only (per the RFC, hosted runners are the only release gate; no self-hosted):

1. Add macos-latest (Apple silicon, arm64) to the published-artifact end-to-end matrix alongside the existing windows and ubuntu jobs. It is free for this public repo.
2. One arm64 runner can validate both darwin assets: run darwin-arm64 binaries natively, and darwin-amd64 under Rosetta 2, which is preinstalled on GitHub's macOS runners. Label the Rosetta leg as smoke-grade in the job name; it proves the binary launches and answers --help and a basic query, not native-hardware behavior. Do not depend on Intel macOS runner images for the gate; they are on the way out and Rosetta covers the amd64 smoke.
3. Toolchain-absence gotcha, same one the Windows acceptance already solved: GitHub macOS runners preinstall Go, Rust, and Cargo. The clean-install criterion (engines usable with Cargo and Go absent from PATH) requires the job to strip or shadow them from PATH before brigade setup runs, then assert every manifest binary resolved from the user-local data directory by absolute path, never from PATH. Reuse the Windows job's approach.
4. Script reuse: pwsh is preinstalled on macOS runners, so scripts/windows-native-acceptance.ps1 can become a shared cross-platform acceptance script if its paths and expected asset keys are parameterized (darwin-arm64 / darwin-amd64 vs windows-amd64). If that turns messy, a bash twin with identical assertions is fine; keep the assertion list in one place either way so the platforms cannot drift.
5. Path filtering: the macOS job belongs in the published-artifact end-to-end workflow (release gate plus manual dispatch), not on every PR. macOS runner queue times are the slowest of the three; per-PR feedback stays on the path-filtered ubuntu jobs.

[solomonneas]

Commit-policy update that postdates this session's start, from the maintainer's global rules (2026-07-20): in-house repository commits now carry co-author trailers for coding agents that did substantial work on them. For the commits on this issue's branch, append:

Co-authored-by: Codex <codex@openai.com>

Verified account-linked identity (OpenAI's codex GitHub user). Add it to the final commits or the PR squash body; one trailer per commit where the agent did the substantive work. External repositories and upstream PRs are unchanged: no trailers there. See CONTRIBUTING.md's credits section (#385) for the policy.