fix(installer): handle flattened macOS app-bundle binary paths (SPI-35)

[ian-pascoe]

Summary

• fix binary path validation for macOS app bundles when archive extraction is rooted at Contents/...
• add a narrow fallback resolver for declared paths like *.app/Contents/MacOS/...
• keep non-app-bundle behavior unchanged
• add regression tests for both app-bundle fallback and non-app-bundle guard paths

Testing

• rustup run stable cargo test -p crosspack-installer expose_binary_ -- --nocapture
• rustup run stable cargo test -p crosspack-installer

Closes SPI-35

[ian-pascoe]

@codex review for bugs and security issues. Particularly, make sure cross-platform functionality is still working as expected

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".