Embeddable Once cache SDK with signed XCFramework release

A new once crate is available for embedding Once into Rust applications. It provides a documented Rust API, C ABI entry points, and Apple module headers so other projects can call into Once. The embedded Microsandbox provider is feature-gated so consumers only pull it in when they explicitly enable it, while the CLI keeps its existing provider support. Release builds also publish a signed and notarized Once.xcframework.zip for Apple platforms, exposing a small C ABI that Swift and Objective-C can use with JSON requests and responses for cache access.