Fleet-wide macOS host config drift detection

Host configuration updates for existing Apple Silicon Mac minis now roll out automatically. The operator computes a fleet-wide host config hash from every rendered install script and embedded binary, and re-pushes the configuration to already-provisioned machines whenever that hash drifts. Previously, only a change to the tart-kubelet binary would re-trigger the install scripts, so firewall, NAT, interface, or fleet-wide config changes had to be applied manually across each host. Existing machines migrate with a single, zero-downtime re-push on the next reconcile after the upgrade.