Java: add Apple Silicon macOS in-process runtime and native classifier publishing - #2402

Implements the darwin-arm64 portion of #2399.

Fixes #2400.

Summary

Adds Apple Silicon macOS (darwin-arm64) as a supported target for the Java SDK's experimental in-process runtime, alongside the existing GNU/Linux linux-x64 and Windows win32-x64 targets delivered by #2301 and #2393.

• Packages a macOS native classifier containing runtime.node, copilot, and platform.properties.
• Activates and validates the darwin-arm64 classifier automatically on Apple Silicon macOS, including when Maven runs with -Pinprocess.
• Extends native fetch, host-validation, artifact-validation, and local-publication tests to cover Darwin artifacts and reject unsupported Intel macOS hosts.
• Runs the Java in-process test suite on macos-26 in addition to the existing Ubuntu and Windows matrix.
• Builds the Darwin classifier on an Apple Silicon macOS runner and adds it to the blocking publication-assembly test.
• Extends both snapshot and Maven Central release workflows so Linux, Windows, and Darwin classifiers are built on their matching native hosts and published together in one Maven deployment.
• Documents Apple Silicon setup, classifier contents, supported-host behavior, and the updated ADR-007 platform status.

User experience

In-process mode remains opt-in, experimental, and unchanged for existing Linux and Windows consumers. The SDK's default connection behavior is also unchanged.

An Apple Silicon macOS application enables in-process mode by:

1. Depending on com.github:copilot-sdk-java-runtime with classifier darwin-arm64, plus JNA.
2. Configuring CopilotClientOptions with RuntimeConnection.forInProcess().

The classifier JAR contains:

native/darwin-arm64/runtime.node
native/darwin-arm64/platform.properties
native/darwin-arm64/copilot

For SDK development on Apple Silicon, mvn -Pinprocess clean verify detects darwin-arm64, validates that the host is macOS ARM64, fetches the pinned @github/copilot-darwin-arm64 package, packages its version-matched runtime and transitional CLI, and exercises the in-process integration suite. Intel macOS and other unsupported OS/architecture combinations fail explicit in-process host validation rather than packaging the wrong binary.

During the active Rust migration, the classifier intentionally includes the version-matched copilot embedded-host executable in addition to runtime.node. It can be removed once the native runtime no longer delegates unported method bodies to the CLI.

Packaging and publication model

This extends the coordinated publication model introduced by #2393 from two native classifiers to three:

The macOS job builds only the darwin-arm64 classifier and a SHA-256 manifest. The sole Ubuntu publisher then:

1. Verifies that the macOS and Windows handoffs came from the same immutable source and Maven version as the Linux build.
2. Verifies each checksum, expected filename, pinned native-runtime version, required contents, and absence of cross-classifier contamination.
3. Attaches the external Windows and Darwin classifier JARs to the Maven reactor.
4. Builds linux-x64 locally and performs one deployment containing the neutral SDK artifacts and all three native classifiers.

Using one deployment preserves a shared Maven snapshot timestamp/build number and ensures release signing covers every classifier. Snapshot and release summaries now report the build host, filename, and SHA-256 hash for all three classifiers.

CI and safety checks

• The in-process Actions matrix covers linux-x64, win32-x64, and darwin-arm64.
• A dedicated macos-26 job builds and validates the Darwin publication input before upload.
• Blocking publication assembly downloads both external native artifacts and validates the complete signed local repository before publication workflows can drift unnoticed.
• Host validation accepts only darwin + arm64 for darwin-arm64; Intel macOS and non-macOS hosts are rejected.
• Artifact validation requires a nonempty Darwin runtime.node, copilot, and matching platform.properties.
• Local-publication validation requires all three classifiers and rejects native resources from the wrong platform.
• Fetch tests cover complete, missing, and stale Darwin staging states.

Validation coverage

• Darwin native-host acceptance and rejection tests.
• Darwin classifier artifact-validation tests.
• Three-classifier local-publication validation and contamination tests.
• Native fetch tests across Linux, Windows, and Darwin classifiers.
• Apple Silicon mvn -Pinprocess clean verify in the Java CI matrix.
• Native publication-input build on macos-26.
• Complete Linux/Windows/Darwin local publication assembly on Ubuntu.