ci: $0 5-target GitHub Actions release pipeline + wrapper macOS/arm64 support

release.yml builds linux-x64/arm64 + win-x64 (cross) on free Linux runners and
macos-arm64/x64 on native Mac runners; packages per the wrapper contract
(juggler-gated so binaries are Playwright-drivable, issue-#14 symlink-safe via
cp -aL), validate_release.py gate, ad-hoc macOS codesign, DRAFT publish.
constants.py: arm64 + darwin ARCHIVE_NAME + BINARY_ENTRY_REL (Firefox.app).
download.py: macOS post-extract xattr quarantine strip.
BINARY_VERSION unchanged (firefox-8); the juggler-fixed firefox-9 is a separate
release cut + pin bump.

tests/test_download.py

@@ -418,7 +418,7 @@ def test_github_token_none_when_unset(monkeypatch):
 # Bonus coverage: unsupported platform raises NotImplementedError before any HTTP
 @pytest.mark.unit
 def test_ensure_binary_unsupported_platform_raises(monkeypatch):
-    monkeypatch.setattr("sys.platform", "darwin")
+    monkeypatch.setattr("sys.platform", "freebsd")  # win32/linux/darwin are supported
     import platform
     monkeypatch.setattr(platform, "machine", lambda: "AMD64")
     with pytest.raises(NotImplementedError, match="unsupported platform"):