ci(platform): verify core portability

[aatuh]

Ticket

CI-002

Summary

• recover and adapt the preserved master@e216516 portability work from legacy commit 78e6c9321e4993b61c7b6efca5a4589acae06829
• require root verification, build, tests, examples, and generated saas-api compilation on Linux amd64, Linux arm64, macOS arm64, and Windows amd64
• replace the deprecated archived macos-14 runner with the fixed macos-15 ARM64 runner label and verify each runner OS/architecture at runtime
• normalize repository-owned text to LF on every checkout so byte-sensitive fixtures and policy manifests behave identically on Windows
• validate canonical slash-form generator manifest paths before converting them to host separators, retaining rooted traversal protection on Windows
• resolve generated-service dependencies before its isolated build
• align the support policy, release notes, generated docs index, and executable docscheck contract

Security invariants

• all third-party actions remain full-SHA pinned
• workflow permissions remain contents: read
• GOTOOLCHAIN=local prevents silent toolchain downloads
• root module verification and generated fixture dependency/build steps use GOWORK=off; repository tests intentionally use the checked-out two-module workspace so docs governance never downloads the withdrawn v4.0.0
• generated output stays under RUNNER_TEMP; commands interpolate only repository-controlled matrix values and fixed arguments
• generator paths reject absolute, traversal, backslash, volume/alternate-stream, and NUL-bearing names before writes; os.Root remains the containment boundary
• no credentials or production endpoints are consumed

Validation

• GOTOOLCHAIN=local make finalize
• GOTOOLCHAIN=local make actions-audit
• GOTOOLCHAIN=local make docs-check
• root cross-builds for windows/amd64, linux/arm64, and darwin/arm64 with CGO disabled
• Windows amd64 test-binary compilation for contrib/cmd/api-toolkit
• focused portable-path, all-manifest, no-side-effect traversal, generated-service build, and getting-started scaffold tests
• simulated core.autocrlf=true checkout proving LF-only workflow YAML, TSV policy data, Go contracts, and Makefile content

The matrix findings were fixed at their boundaries: workspace isolation is limited to operations that require it, generated modules run go mod tidy before build, .gitattributes makes repository-owned text deterministic, and generator manifests are validated in platform-independent slash form before conversion to native paths.

The backlog remains [pr] until this protected implementation PR and its separate merge-evidence reconciliation PR are merged.