build: add Darwin release artifact package target

[Jess Sullivan (Jesssullivan)]

Summary

• Adds pinned Bzlmod http_file inputs for the published v0.12.14 macOS CLI tarball and FileProvider zip.
• Adds //build/macos:darwin_package_release_artifacts_unsigned plus root alias //:darwin_package_release_artifacts_unsigned.
• Documents that this is a real non-fixture package-assembly target, but still unsigned and not a Developer ID/notary/staple proof.
• Extends the Bazel macOS package contract regression test for the release-artifact target and pinned digests.

Validation

• bash -n scripts/test-bazel-macos-package-contract.sh
• shellcheck scripts/test-bazel-macos-package-contract.sh
• bash scripts/test-bazel-macos-package-contract.sh
• task lazy:test-bazel-macos-package-contract
• bazel mod deps --lockfile_mode=error --noshow_progress
• bazel query //build/macos:darwin_package_release_artifacts_unsigned --noshow_progress
• bazel query //:darwin_package_release_artifacts_unsigned --noshow_progress
• bazel build //build/macos:darwin_package_release_artifacts_unsigned --noshow_progress
• git diff --check

Boundary

The Bazel build produced bazel-bin/build/macos/tcfs-0.12.14-macos-aarch64-release-artifacts-unsigned.pkg and package structure smoke passed. This is local package assembly from pinned release assets only. It is not RBE evidence, not current-source build proof, and not signed/notarized/stapled package proof.