P5.8: add a macOS .app bundle smoke test to the corpus (closes the no-bundler-coverage gap)

The corpus had ZERO bundler coverage (the stream's named top risk). Add a `.build`
`bundle` directive to the corpus runner: after a successful `aot` build it asserts
each `expect` entry exists under the produced `.app` (repo-relative), then `rm -rf`s
it. macOS-host only — the `.app` + codesign are Apple-specific, so the example is
skipped on other hosts.

`examples/1665-platform-macos-bundle-smoke.sx` sets `bundle_path`/`bundle_id` via a
`#run` config; `default_pipeline` auto-bundles (build.sx imports the bundler, no
explicit `on_build` needed). The directive asserts `Contents/MacOS`,
`Contents/Info.plist`, `Contents/_CodeSignature`. Verified: passes on BOTH gates
(the bundler runs on the legacy interp AND the VM), the `.app` is cleaned up, and a
bad `expect` entry correctly fails (the check is not vacuous). Unit test +
CLAUDE.md `.build`-directive docs updated. 706/0 both gates.

examples/expected/1665-platform-macos-bundle-smoke.build

@@ -0,0 +1 @@
+{ "aot": true, "bundle": { "app": ".sx-tmp/1665-platform-macos-bundle-smoke.app", "expect": ["Contents/Info.plist", "Contents/MacOS", "Contents/_CodeSignature"] } }

examples/expected/1665-platform-macos-bundle-smoke.exit

@@ -0,0 +1 @@
+0

examples/expected/1665-platform-macos-bundle-smoke.stderr

@@ -0,0 +1 @@
+

examples/expected/1665-platform-macos-bundle-smoke.stdout

@@ -0,0 +1 @@
+bundle smoke ok