Post-#150 advisory follow-ups: macOS compiled-run FFF validation in CI; prune superseded content-addressed sidecars on install/upgrade #151

Folded as non-blocking advisories during the #150 review rounds (all four seats approved; these never gated convergence). Recording them as the durable follow-up per the merge report:

1. macOS compiled-run FFF validation — fff-platform-validation.yml exercises the compiled FFF distribution only on Windows x64/arm64; the macOS Nix jobs build opencode but never LAUNCH it with FFF. The darwin path (dylib beside execPath, vmmap mapping check) is validated nowhere in CI.
2. Superseded sidecar pruning — download_and_install, install_from_binary, and local-release.sh never remove superseded content-addressed FFF sidecars from previous versions; they accumulate in the install dir across upgrades.
3. nix/bun.nix override unveils — the override sets version + passthru.sources only; whether nixpkgs bun's src follows the overridden passthru is unveiled behavior worth an explicit assertion.