fix(storage): support secure macOS package use

[drewstone]

What failed

The exact installed 0.1.1 candidate passed on Linux but failed encrypted SQLite startup on macOS. Darwin can reopen /dev/fd/N but cannot traverse /dev/fd/N/child. The Windows candidate also exposed an existing boundary: secure SQLite startup is intentionally unsupported there.

Fix

• Resolve each Darwin directory descriptor through realpath before opening its child, while SQLite remains bound to the already opened database file.
• Run an encrypted storage use check on macOS for every PR.
• Publish only the two honestly supported targets: Linux x64 and macOS arm64.
• Make npm reject Windows instead of installing a product that cannot start securely.
• Give package installation its own bounded ten-minute timeout and report timeout explicitly.

Direct checks

• 58/58 storage tests pass.
• 229/229 unit tests pass.
• TypeScript passes.
• Both GitHub workflows pass actionlint.
• macOS CI performs the real encrypted append, replay, and integrity flow.