fix: run macOS service-wrapper unit tests in CI

[mvanhorn]

Summary

Adds a macos_unit CI job so the macOS service-wrapper unit tests in crates/core/src/bin/commands/service.rs actually run on every PR. These tests are gated behind #[cfg(target_os = "macos")] and were compiled out on the Linux-only Unit & Integration job, so they never executed in CI.

Why this matters

The launchd plist generation and exit-43 self-heal behavioral tests (test_macos_wrapper_*, test_exit43_heal_decision_behavior, test_launchd_plist_generation) were silently skipped. A regression in the macOS exit-43 heal logic could pass CI undetected. See #4410.

Changes

The new macos_unit job runs on macos-latest and mirrors the test_unit job:

• same dtolnay/rust-toolchain (1.93.0), Swatinem/rust-cache@v2, and nextest setup (macOS installer)
• same pull_request / merge_group guard so it does not run on push to main or release branches
• omits the Linux-only mold linker step and CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_* env vars
• scopes the run to the service command surface: cargo nextest run -p freenet --bin freenet -E 'test(commands::service)'

Testing

On a macOS host:

• cargo build --locked -p freenet --bin freenet succeeded
• cargo nextest run -p freenet --bin freenet --profile ci -E 'test(commands::service)': 72 passed, 138 skipped. The macOS-gated tests including test_exit43_heal_decision_behavior, test_macos_wrapper_script_generation, and test_launchd_plist_generation ran and passed.

Fixes #4410

AI was used for assistance.

[CLAassistant]

All committers have signed the CLA.

[github-actions]

Rule Review: Commit prefix mismatch (minor)

Rules checked: git-workflow.md
Files reviewed: 1 (.github/workflows/ci.yml)

Warnings

None.

Info

• .github/workflows/ci.yml (commit message) — The commit uses fix: prefix, but per the workflow rules ci: is the correct prefix for CI/workflow configuration changes (ci: – CI/workflow configuration). The change adds a new CI job; nothing in the production or test source tree is modified. The fix: prefix creates a false expectation of a regression test for a code bug, even though the "fix" here is the CI job itself. (rule: git-workflow.md, "Valid prefixes")

• .github/workflows/ci.yml:33 — The macos_unit job installs the wasm32-unknown-unknown target (targets: wasm32-unknown-unknown) but neither build step targets wasm — the job only builds and tests the native freenet binary. This adds unnecessary download/compile time. (cosmetic; not a rule violation, just wasted CI minutes)

---

Rule review against .claude/rules/. WARNING findings block merge.