feat(native): expose a minimal macOS WebView host

[pranavp311]

Supersedes #100 with the first deliberately small native macOS slice.

What changed

• Added mer.native.runLoopback, a minimal public API that presents an already-bound loopback server in the system NSWindow + WKWebView.
• Reused that API from the existing desktop example, fixed its Zig 0.16 readiness calls, and initialized the framework I/O runtime before the server thread starts.
• Kept the URL internal and loopback-only, validated window inputs, enforced AppKit's main-thread contract, and made closing the final window return from the event loop.
• Added macOS compile/link and bundle validation to release-targeted CI and tagged-release gating.
• Kept every commit below 400 changed lines; the largest is 228 lines. The whole PR is 499 changed lines across 8 files.

Why

• Problem/failure mode: The existing desktop example duplicated all Objective-C host code, no longer compiled against the current ServerReady API, and could use the server before runtime.init. The previous native proposal grew to hundreds of files and mixed the shell with bridges, updaters, signing, packages, and unrelated framework work.
• Reason for this approach: This promotes the already-proven macOS spike into one reusable framework seam while leaving HTTP routing and server behavior unchanged. It is the smallest useful foundation for downstream apps such as Codegraff.
• Constraints and trade-offs: Apps still own server startup/shutdown and must link AppKit, WebKit, Foundation, and libc. The repository's example server remains process-lifetime because Server.listen has no graceful stop API yet.
• Rejected alternatives: This does not salvage or split the old mega-PR. Manifest packaging, JavaScript-to-Zig commands, permissions, signing/notarization, updates, and other platforms are intentionally deferred to separately approved PRs.

Validation

• zig build test --summary all — 25 passed, 2 skipped
• zig build prod
• zig build cli
• zig build desktop -Doptimize=ReleaseSmall
• plutil -lint zig-out/MerApp.app/Contents/Info.plist
• targeted zig fmt --check
• git diff --check
• independent adversarial review loop completed with no actionable findings

[pranavp311]

Hosted validation update:\n\n- Fork macOS job passed framework tests, ReleaseSmall desktop compile/link, executable check, and plutil -lint: https://github.com/pranavp311/merjs/actions/runs/30888094961\n- The inherited Ubuntu job failed in Zig 0.16 stdlib Io/Uring.zig; the exact base SHA already has the same upstream CI failure: https://github.com/justrach/merjs/actions/runs/24634534013\n- Upstream PR Actions are currently awaiting maintainer approval: https://github.com/justrach/merjs/actions/runs/30888112361\n\nNo core Linux/runtime changes are included here; that baseline CI failure should remain separate from this 8-file native PR.