Fix #365: verify each lipo architecture separately in universal macOS steps

[AlexMikhalev]

Summary

lipo from Xcode 27 rejects several architectures in one -verify_arch call (lipo: -verify_arch requires exactly one input file), whichever side the file is on. That failed the "Create universal macOS binary" job of the terraphim_mcp_server-v1.21.18-rc.1 release-mcp run (all five per-target builds passed).

• release-mcp.yml and release-binaries.yml (same multi-architecture form in create-universal-macos) now run lipo FILE -verify_arch <arch> for x86_64 and arm64 separately, then require lipo -archs to list exactly those two. The stale "Xcode 16.4" comments are replaced.
• Contract tests updated: test_universal_lipo_verify_arch_uses_safe_argument_order now pins the per-architecture form with mutations (flags-first, multi-arch, verify dropped, archs check dropped); a new release-mcp test pins the same.

Refs terraphim/terraphim-clients#365 (Gitea)

Evidence

• Reproduced locally with this Mac's lipo: the multi-arch form fails; per-architecture checks pass.
• Both workflow fragments were executed for real against a clang-built universal binary (pass) and a thin x86_64 binary (fail), under set -euo pipefail.
• actionlint (including shellcheck on the run scripts) clean; release contract tests pass apart from the three existing macOS-only /bin/true errors.

🤖 Generated with Claude Code

[AlexMikhalev]

Structural review (pi-rust, openai-codex/gpt-5.5, structural-pr-review)

No blocking findings; confidence 0.86. Both workflow fragments were judged shell-correct under set -euo pipefail and correct for older and newer lipo (per-architecture presence check plus an exact lipo -archs slice check).

1. Low: the release-mcp lipo contract test was substring-only without mutation checks. Accepted and fixed: it now has a helper plus four mutants (flags-first, multi-architecture, verify dropped, -archs check dropped), each of which must fail.

Evidence beyond the review: both workflow fragments were executed for real with this Mac's lipo against a clang-built universal binary (pass) and a thin binary (fail). CI is green on the self-hosted runner on the earlier head 38d4739 (the later commit changes only a test).