ci: unblock remaining macOS and iOS workflows

[AnthonyRonning]

GitHub billing restrictions prevent the remaining larger Mac runners from starting Research macOS/iOS and ONNX builds. Replace all 14 remaining macos-26-xlarge selections: eight native/ONNX producers use the already validated Blacksmith 6 CPU Mac pool; six artifact verifiers and TestFlight consumers use standard GitHub macos-26.

Select release Xcode by runner.os so the new provider label still activates exact Xcode 26.5/build 17F42. Keep existing cache keys, ONNX pins, source/event restrictions, protected environments, signing and artifact checks, release identities, and independent Dev/Prod queues. Retain the unsigned PR ONNX warmer for now; its removal is deferred.

Research signed builders retain their existing signing environments. This places the separate four-secret apple-signing context on Blacksmith for iOS builds, in addition to the existing desktop-signing trust. Merging can resume the existing automatic Dev and Prod TestFlight builds and uploads after artifact verification. Protected Research signing/export/notarization on Blacksmith still needs confirmation from the ordinary approved master execution; previous unsigned Mac trials do not prove those paths.

Validation:

• nix flake check --no-update-lock-file --print-build-logs: all 11 checks passed on aarch64-darwin.
• Repository hook: actionlint for all five changed workflows and all 433 existing CI-script tests passed.
• Independent final source review and git diff --check passed.
• Hosted PR checks and credential-free native proxy Mac rehearsal will run on this final head.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}