test(ci): run the atomic suite on macOS against PR builds

[Karib0u]

Description

The CI atomic job runs the rustinel-rules atomic suite against the PR build on Linux and Windows only. macOS is not exercised.

Observed

• The rustinel-rules atomic workflow runs on the hosted macos-latest runner with the released v1.6.0 binary. On its latest main run (34257814503), all 8 gating macOS tests passed, so Endpoint Security initialises on hosted runners.
• ci.yml pinned RUSTINEL_RULES_REF to 5b8f001, a commit on an unmerged rustinel-rules branch, and release.yml pinned the older c1d78b4. fix(atomics): retain Windows YARA fixtures until scanning can finish rustinel-rules#55 is now merged as be877b7, and ci: pin rustinel-rules to be877b7 on main #489 moves both pins to it.

Proposed fix

• Add a macos-latest leg to the atomic job, building the PR binary with the Endpoint Security entitlement the same way the release does, running the harness under sudo.
• Start it non-blocking, like the other legs on pull requests; make it blocking on main once it is stable.

Acceptance criteria

• RUSTINEL_RULES_REF points at a rustinel-rules main commit in both workflows (ci: pin rustinel-rules to be877b7 on main #489).
• The atomic job has a macOS leg that runs against the PR build.
• The macOS report and engine logs are uploaded as artifacts, as for the other legs.

References

• test(ci): run atomic detection suite against PR and release artifacts #344 (atomic suite against PR and release artifacts).
• Found in the 2026-09-11 detection coverage audit.