Run macOS viewer rendering in a docker-mac-x64 guest on a Linux runner

[zackees]

Summary

Follow-up to the macOS live-test lane added in #242 (macos-arm-live-test.yml).

That lane cross-compiles on Linux, but it still holds a GitHub-hosted macos-15 runner to execute:

• the Rust test archive,
• the live WKWebView viewer render,
• the Safari smoke test.

This issue tries moving that execution into a macOS guest running under Docker on an ordinary Linux runner, the same way other repos already do:

Repo	Workflow	What runs in the guest
zackees/soldr	macos-recovery-replay.yml	Replays the x86_64-apple-darwin nextest archive on every PR, in a zackees/docker-mac-x64 Recovery guest.
zackees/kernal-api	macos-x64-tests.yml	Cross-builds Intel test binaries with soldr, pulls a prebaked guest from GHCR, and runs the archive over SSH. The runner needs KVM permissions and a disk-space step.
zackees/bosn, zackees/mimalloc-pprof	macos-x64-execute.yml, macos-bundles.yml	Same pattern.

Scope

1. Cross-build the x86_64-apple-darwin wheel and nextest archive on Linux (the same steps as the ARM lane, with a different target).
2. Boot a docker-mac-x64 guest on ubuntu-latest with KVM enabled.
3. In the guest:
   • run the test archive;
   • install the wheel and run fastled <sketch> --test in the shipped viewer;
   • run ci/safari_smoke.py against the compiled sketch.
4. Upload the screenshots and logs, as the hosted lane does.

Open questions and risks

• Intel only. docker-mac-x64 and dockur have no arm64 image, so this can cover x86_64-apple-darwin but not Apple Silicon. The hosted macos-15 lane is still the only arm64 execution.
• Rendering without a GPU. The guest runs under QEMU with software graphics. WKWebView and Safari need a logged-in WindowServer session and WebGL2, possibly through a software rasterizer. A Recovery guest may not provide a usable WebKit/Safari at all, so a full prebaked install (kernal-api's macos-x64-guest:ventura) is probably required. Measure whether a frame renders before committing to it.
• Per-PR cost. kernal-api runs its guest nightly because boot plus a slow guest exceeds a PR loop. Decide nightly vs per-PR from measured wall time.
• Headless automation. safaridriver --enable needs admin in the guest, and the viewer window needs a GUI session. Both have to be baked into the image.

Acceptance

• A Linux-hosted workflow reports a real Intel macOS viewer render (screenshot artifact) and a Safari frame for a sketch.
• The measured duration is recorded, and the lane is scheduled per PR or nightly based on it.
• If rendering in the guest proves impossible, record why and keep the hosted lane.