fix(ci): restore macOS maturity gates and watch aliases

[cervantesh]

What changed

• re-declare the two Slice 5.5c source hashes changed by PR ci(macOS): add hosted build/test coverage; fix two macOS-only bugs #231 and update the manifest artifact pin
• remove trailing whitespace from the committed macOS fuzz evidence so the historical git diff --check gate can pass
• group watch paths by canonical identity while retaining every original path
• add an end-to-end regression test proving a parent-directory symlink retarget is detected even when file bytes are identical

Root cause

PR #231 correctly canonicalized parent directories for macOS aliases, but the closed Slice 5.5c manifest still pinned the pre-fix font files. Its watch-path deduplication also retained only one original path per canonical identity, so a second user-created directory alias could be retargeted without triggering reload.

Validation

• go test ./...
• go vet -unsafeptr=false ./...
• go test -tags glfw ./internal/frontend/glfwgl ./cmd/cervterm -count=1
• go test ./internal/fontglyph/raster -count=1
• go run ./scripts/check-slice55c-evidence.go -> slice 5.5c evidence ok

The full aggregate maturity command exceeded the local 10-minute execution window without producing a verdict; CI remains the authority for that aggregate job.

Closes #233.