[codex] isolate arm64e GitHub runner diagnostics

[cypherair]

Summary

This draft PR carries the current arm64e experiment stack plus one additional CI-only diagnostic commit to isolate the remaining GitHub-hosted runner failure.

The new change adds a runner comparison workflow for arm64e host-binary smoke tests so we can distinguish between:

• a TLS-specific failure
• a macOS 15 hosted runner limitation
• a broader hosted-runner restriction on executing arm64e host binaries

What Changed

• expanded Fork arm64e validation from a single macos-15 job to a macos-15 / macos-26 matrix
• kept the existing arm64e codegen checks, targeted tests, and stage1 std toolchain build
• replaced the single TLS smoke with four non-blocking host-binary diagnostics:
  • hello world
  • std::thread::current().id()
  • indirect function pointer smoke
  • thread_local! TLS smoke
• standardized per-smoke evidence collection:
  • file output
  • process return code or signal
  • stdout / stderr
  • .ll / .s capture for function-pointer and TLS probes
  • authenticated-call instruction matches (braaz, blraaz, blr)
• added runner fingerprint output so macOS 15 and macOS 26 runs can be compared directly in artifacts and summaries
• kept smoke diagnostics non-blocking so this branch can collect evidence without turning the workflow into a hard gate yet

Why

The current fork validation workflow still reproduces a stable SIGKILL (9) when running the arm64e TLS smoke on GitHub-hosted macOS 15 runners, even though the same minimal repro succeeds locally on macOS 26.4.1.

This PR is meant to isolate whether that remaining failure is TLS-specific or runner-environment-specific before changing compiler logic again.

Validation

Local validation for the new diagnostic shape was run with the existing stage1 toolchain:

• hello smoke: passed
• thread_id smoke: passed
• fnptr smoke: passed, with blraaz in assembly
• tls smoke: passed, with blraaz in assembly

Notes

• This branch is based on codex/arm64e-darwin-ptrauth-spike, so targeting main means the draft PR includes the full arm64e experiment stack plus the new diagnostic commit.
• This PR is draft-only for investigation and comparison, not a ready-for-review upstreaming shape.

[cypherair]

Superseded by #4 (codex/arm64e-upstream-prep-2026-04-24), which carries the rebuilt upstream-prep stack plus the fork arm64e validation workflow. Closing this older runner-isolation draft PR; keeping branch cleanup until PR #4 regular CI has finished.