build: produce a universal (arm64 + x86_64) macOS slice

[prakashrj]

Problem

The macOS build is Apple-Silicon-only by construction, so an app embedding TailscaleKit can't produce a universal macOS release build:

TailscaleKit.xcframework is missing architecture(s) required by this target
(x86_64), but may still be link-compatible

Two places pin it:

Where	What
root Makefile — c-archive	builds libtailscale.a for the host arch; no GOARCH is set
swift/Makefile — macos	-destination 'platform=macOS,arch=arm64', so the framework is one arch even if the archive were fat

Approach

The iOS Simulator target already solves exactly this — separate GOARCH=arm64 and GOARCH=amd64 c-archives joined with lipo, each built through a clangwrap script pinning SDK and arch. This mirrors that pattern rather than inventing a second one:

• clangwrap-macos-arm.sh / clangwrap-macos-x86.sh, matching the existing ios-sim wrappers and pinning -mmacos-version-min to MACOS_TARGET (15.0)
• libtailscale_macos_arm64.a and libtailscale_macos_x86_64.a
• c-archive-macos-universal, which lipos them into libtailscale.a
• swift/Makefile's macos target uses it, and builds with -destination 'generic/platform=macOS' ARCHS="arm64 x86_64"

make c-archive is untouched, so anything building for the host only keeps its current behaviour.

Verified

On an Apple Silicon host:

$ lipo -info libtailscale.a
Architectures in the fat file: libtailscale.a are: x86_64 arm64

$ make -C swift macos
$ lipo -info swift/build/.../TailscaleKit.framework/Versions/A/TailscaleKit
Architectures in the fat file: ... are: x86_64 arm64

Both the archive and the built framework come out universal.

Scope

4 files, +13 −2, two of them new scripts. No existing target changes behaviour.

Updates tailscale/tailscale#20992

Related: #57 (privacy manifests, macOS slice, upload validator) and #58 (LocalAPI actor deadlock), from the same work.