Skip macOS App stages when producing Simulator native inputs

[RCmerci]

Generating Simulator host OCaml evidence previously continued into unrelated macOS Swift, packaging and signing. Add macos --producer-only --switch ... to stop after native production and final input validation, returning an immutable schema-2 envelope and status: native-produced.

The mode keeps cache/switch locks, locked preflight, source/compiler/dependency identity, current Dune argv and original archive/unit proofs. It removes host DNS/crypto only from an owned archive copy, binds runtime headers before handoff, validates runtime/mldoc retention and rechecks live inputs. Warm reuse reads the current Dune rule and importer ancestry/bytes. A producer receipt cannot authorize historical target inputs. The normal experimental Simulator path still compiles target C/Swift and verifies providers, platforms and signing; cross_abi_validated=false.

This PR is stacked on #90, base fec63d8f97a0dbf5c3cf519f59bcc6a45cbf1978. No protected spec/Dune/pin or product UI change.

Validation:

• Material-code local validation: 54 build-owner tests passed in 67.449s, no skips. A later CI-only fixture PATH issue was reproduced and fixed; two real cases passed in 8.803s with no global OCaml PATH. The fixture now uses only the selected switch bin plus system tools; no fallback or skip was added. Real RED→GREEN for ancestor reuse and runtime-header mutation; private fixtures do not modify the prepared switch.
• Four final Simulator builds passed fresh target C/provider checks, 54 Swift object platform checks, runtime/mldoc retention, signing and final input validation.
• Independent journal-code-review at final head f26a2fd7deba7cf6335701bc498095c7674e5058 found no open actionable issues after closing both code findings and the stale documentation note.
• Exact-head full-source CI passed on f26a2fd: 54 helper tests (69.293s), all targets/native embed, full regressions and final cache-input sealing; PR build-and-test and WIP both passed.
• New decision document validates; global document checking retains three pre-existing unrelated format failures.

One bounded cold/hot pair on clean source/native 801cddf, one prepared compiler/locks/SDKs, Release/jobs=2 and the same absolute native cache path:

Measured stage	Cold	Hot
Removed auxiliary macOS Swift subprocess	35.274s	2.695s
New producer-only CLI	24.124s	6.874s
Following Simulator build	45.923s	6.111s

Both cold native traces show 268 OCaml compile calls, 11 archive calls, one complete-object link and three C compilations; both hot traces show zero compile/archive/link actions. Producer relinking runs once cold and zero times hot, proving reuse beyond directory existence.

The auxiliary legacy macOS App failed at listSectionSpacing; packaging/signing did not run and their saving is unmeasured. Observed recovery-route totals were 112.731→70.053s cold and 18.944→12.991s hot, not a strict successful-App end-to-end acceleration claim. Fourteen rebuilt archive hashes differ only in date metadata (all member payloads identical), selecting different Simulator namespaces. A successful full-macOS-App baseline and exact equivalent end-to-end saving are not established. Cold means a fresh owned build cache, not cold OS caches or a dependency reinstall. Resource/approval/setup waits are excluded. Raw argv, traces, phase logs and artifact/receipt hashes are retained outside the checkout.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T07:47:33.114389Z	59fd2ab	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.