fix: add Metal JIT entitlements for hardened runtime code signing

Hardened Runtime blocks Metal shader JIT compilation without explicit
entitlements. Adds allow-jit, allow-unsigned-executable-memory, and
disable-library-validation to enable Metal compute pipeline creation.

Made-with: Cursor

Author: Vect0rM

.github/entitlements.plist

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>

.github/workflows/build-turboquant-macos.yml

@@ -114,6 +114,7 @@ jobs:
             if [ -f "$bin" ]; then
               echo "Signing $bin ..."
               codesign --force --options runtime --timestamp \
+                --entitlements .github/entitlements.plist \
                 --sign "$CODESIGN_IDENTITY" "$bin"
               codesign --verify --verbose "$bin"
             fi