Embeddable Once SDK with signed Once.xcframework release

A new embeddable once Rust crate exposes a documented cache API, stable C ABI entry points, and Apple module headers. The embedded Microsandbox provider is feature-gated so SDK consumers do not pull it in unless they explicitly enable it, while the CLI keeps its existing provider support. Release packaging produces a signed and notarized Once.xcframework for Apple distribution.