Run Rust CI on macOS and scope workflow token permissions

[Copilot]

The failing build Actions job was running the desktop app on ubuntu-latest, where linking failed on Linux-only system dependencies (xcb/xkbcommon). This change aligns CI with the app’s actual platform target and tightens the workflow token scope.

• CI platform

  • Run the build job on macos-latest instead of ubuntu-latest
  • Keep the existing cargo build / cargo test flow unchanged

• Workflow hardening

  • Add explicit GITHUB_TOKEN permissions for the job
  • Limit access to the minimum needed: contents: read

• Result

  • The workflow now executes on the supported GPUI/AppKit/Metal platform instead of failing during Linux linking

jobs:
  build:
    permissions:
      contents: read
    runs-on: macos-latest

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T23:21:49.000459Z	a6bc7c6	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.