Feature: Add and validate macOS (darwin) support for cross-user Sessions

[andychoquette]

Description

Context

The Python implementation (openjd-sessions-for-python) will gain macOS
support for running Session actions as a jobRunAsUser. Reference PR:

Per the cross-port policy in that repo's PR template, this issue tracks the
corresponding macOS support in the Rust crate (crates/openjd-sessions) so the
two implementations stay in sync until the migration completes.

Why the Python fixes do NOT port directly

The Python macOS work fixes three issues that are specific to the Python
implementation's mechanism and do not appear to exist in the Rust design:

1. Missing setsid(1). Python shelled out to the setsid binary
   (sudo -u <user> -i setsid -w <cmd>), which does not exist on macOS. The
   Rust crate instead calls nix::libc::setsid() directly in a pre_exec hook
   (subprocess.rs::configure_command), which is available on macOS — so this
   failure mode should not occur in Rust.

2. pgrep-based signal-target discovery. Python discovers the workload PID
   via pgrep -P <sudo_pid> (and had a bug treating "no match yet" as fatal).
   The Rust crate signals by process group directly
   (notify_process_group/terminate_process_group) and does not use pgrep,
   so that discovery/retry bug does not apply.

3. is_macos() helper. Trivial; add if/when needed for cfg branching.

In short: this is a "verify and validate on macOS" task, not a code port.

What actually needs doing

• Confirm the cross-user launch path works on macOS. cross_user_helper.rs
  / helper_binary.rs launch a compiled helper via
  sudo -u <user> -i <helper_path>; review for any Linux-specific
  assumptions (paths, /proc, capabilities, home-dir handling) and confirm
  the helper binary is reachable/executable by the jobRunAsUser on macOS.
• Confirm pre_exec + nix::libc::setsid() yields a workload process group
  distinct from sudo's on macOS (the property the Python shim had to
  reproduce manually), and that notify_process_group / terminate_process_group
  signal it correctly.
• Add macOS to CI / platform cfg gating if the crate's existing target_os
  gates don't already cover it.
• Validate end-to-end on a macOS host, mirroring the Python validation:
  run a Session action as a jobRunAsUser, then cancel it and confirm the
  process group is reaped with no orphaned processes.
• Note the macOS Command Line Tools prerequisite only applies to the Python
  implementation (it uses /usr/bin/python3); the Rust helper is a compiled
  binary, so it should have no such dependency — confirm.

Reference

• Python PR (mechanism, validation notes, security review): PR
• Python validated end-to-end on macOS 26.5 (arm64) via the AWS Deadline Cloud
  worker agent against a live customer-managed fleet.

Solution

Run through the work items listed in the issue description.

[mwiebe]

Both the Linux and Windows cross-user solutions have tests that run in the GitHub CI, and I think macOS CI runner is open enough that it can do that too.