fix(release): package macOS FIPS libraries for macOS 11

[jeremi]

Summary

AWS-LC-FIPS refuses static macOS builds, which prevented the v0.33.0 candidate from producing its native executables and client packages. Package the supported shared module with each macOS artifact, relocate its load paths, and sign and verify the modified Mach-O files. The eight executable assets become self-contained archives; Node and Python package names and APIs stay the same.

The installers retain a private library closure per command and verify the staged version before their existing atomic switch. Candidate smokes hide Cargo build outputs to prove the installed artifacts contain their runtime dependencies. Pin macOS 11 before compilation, refuse packages whose executable or dylib metadata exceeds that minimum, and prevent old CMake deployment targets from returning through the macOS cache restore prefix. Refresh the untagged v0.33.0 documentation archive; the comparison gate permits only the current, fully identified candidate to change after authoritative tag absence is positively verified. Published and historical locks remain immutable.

Evidence

• 172 focused release integration tests passed, covering relocation, native shards, client assembly, installer failure rollback, candidate inventory, public verification, and workflow structure.
• 69 gate-inventory tests, the 213-gate inventory, Node facade synchronization, Bash syntax checks, actionlint 1.7.12, and diff checks passed.
• 13 archive-lock test cases passed, including published tags, historical changes, removals, authentication failures, ambiguous output, and timeouts. The actual comparison against protected main passed with live authoritative tag lookup.
• Real macOS ARM64 Casework release builds passed. With the build target hidden and dynamic-loader environment variables cleared, the actual installer, both version checks, and the maintained init/check/test/package journey passed. Strict code-sign verification passed; the packaged FIPS module reported enabled mode and completed a random-byte operation.
• All five Node bindings built and the exact assembled packages passed installed CommonJS and ESM smokes with build outputs hidden. The unified Python wheel also passed installation, pip check, and its maintained API smoke with build outputs hidden. All five bindings and the bundled library in each package have a macOS 11.0 minimum. The fresh native rebuild also passed at minimum macOS 11.0, including install/first-run and actual packaged-library FIPS/RNG operation. The corrected installer was rechecked against those exact native archives.
• Canonical Linux AMD64 documentation preparation passed its source, build, link, and archive checks. Only the unpublished v0.33.0 lock differs from main; all 39 historical records are preserved.
• After the deployment-target correction, the 20 helper/native tests, 27 client assembly tests, and 127 workflow/gate tests passed. The generated-installer currency check, 19 glibc/installer tests, and 100 CI-routing tests also pass. An explicit return after argparse error termination resolves the CodeQL control-flow alert; 17 focused helper/wheel tests and an actual failing CLI invocation pass. Protected CI and a fresh strict release rehearsal must pass before merge.

Notes

Linux and releases through v0.32.0 retain their existing artifact formats. This changes packaging, not the required FIPS backend or product authorization behavior. The local native proof uses pinned Go 1.24.4; the final candidate supplies the exact hosted build and runtime evidence for every platform.

DCO

• Every commit includes a Signed-off-by trailer.
• I reviewed the submitted changes and am responsible for the contribution.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-22T14:57:27.349840Z	ca6e8a2	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 70201ec9b9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bd2ac0a24d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".