feat(release): merge binaries into snapshot CI; expose version + build-macOS provenance

Stable releases never got binaries: the snapshot workflow publishes with
GITHUB_TOKEN, whose events GitHub suppresses, so the release-triggered
Build Binaries workflow never fired for CI releases. Build them in
snapshot.yml itself (commit-stamped via --define) and attach them to the
same release; beta publishes cross-compile the same pair locally.

Surface the snapshot's build macOS (it decides the SF Symbols catalog +
font set) in the release title, release notes, web footer, and `status`;
add `apple-docs version`/`--version` (tool version + commit + corpus
provenance) and version/commit on /healthz. Also guard formatStatus
against the projected envelope's missing staleRoots (pre-existing crash).