fix: build darwin-arm64 release binaries with GOOS=darwin

[martijnwalraven]

What

Every auth-v*-darwin-arm64.tar.gz release asset since rc2.189.0-rc.1 contains a Linux ELF binary under the darwin name, so it can never execute on macOS:

$ file auth   # from auth-v2.192.0-darwin-arm64.tar.gz
auth: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked

The cause is one token in the Makefile — the auth-darwin-arm64 recipe sets GOOS=linux, a copy-paste of the auth-arm64 recipe above it:

auth-darwin-arm64: deps
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(call BUILD_CMD,$(@),)

This PR changes it to GOOS=darwin and adds a verify-release target so a name/content divergence fails the release instead of shipping.

Timeline

• chore: add support for building darwin/arm64 binaries #2400 introduced the darwin-arm64 build correctly (GOOS=darwin, merged 2026-03-02); v2.188.0/v2.188.1 shipped genuine Mach-O binaries.
• feat: improve parallelization in github workflows and Makefile #2436 restructured the inline release builds into per-target rules for parallelization (merged 2026-03-25); the new auth-darwin-arm64 rule was written with GOOS=linux.
• Every release from rc2.189.0-rc.1 onward ships the mislabeled binary — verified with file(1) against v2.188.1 (Mach-O, the pre-regression control), v2.189.0, v2.191.0, v2.192.0, v2.192.1-rc.2, and v2.193.0-rc.3 (all ELF).

Why nothing caught it

The archive name comes from the make target stem, while the archive content comes from the recipe's env vars — nothing checks that they agree. The release-notes checksums are computed over the same wrong binary, so checksum verification can't catch it either. Downstream, the consumer this asset appears to have been added for (the local stack's native mode in supabase/cli) restart-loops the un-executable binary with no diagnostic, so the failure never surfaced as a report.

The new verify-release target closes that structural gap. It hooks into the existing release target, so it runs inside the current make release CI step — no workflow change needed:

verify-release: $(foreach t,$(RELEASE_TARGETS),release-$(t)/auth)
	file release-x86/auth | grep -q 'ELF'
	file release-arm64/auth | grep -q 'ELF'
	file release-darwin-arm64/auth | grep -q 'Mach-O'
	file release-amd64-strip/auth | grep -q 'ELF'
	file release-arm64-strip/auth | grep -q 'ELF'

Verification

• With the fix: make release-darwin-arm64/auth && make verify-release passes, file reports Mach-O 64-bit executable arm64, and the binary executes on a darwin-arm64 host (prints usage).
• Guard checked in both directions: reverting the GOOS token and rebuilding makes make verify-release fail the build (make: *** [verify-release] Error 1).
• The v2.188.1 assets prove the darwin cross-compile has always worked from the Linux runners (pure Go, CGO_ENABLED=0) — only the env var was wrong.

Existing release assets can't be fixed retroactively; the first release after this lands ships the first working darwin-arm64 binary since v2.188.1.