Add embeddable Once SDK and signed XCFramework release

Summary

• Add a new embeddable once crate with a documented Rust API, C ABI entry points, and Apple module headers.
• Feature-gate the embedded Microsandbox provider so SDK consumers do not pull it unless explicitly enabled, while the CLI keeps its existing provider support.
• Add release packaging for Once.xcframework, including encrypted Developer ID signing material, codesigning, notarization, and CI artifact upload.
• Document Rust and Apple integration paths in the README and crate README.

Testing

• mise exec -- cargo check --workspace
• mise exec -- cargo test -p once
• mise exec -- cargo doc -p once --no-deps
• mise exec -- cargo clippy -p once --all-targets -- -D warnings
• mise exec -- cargo build -p once --release
• bash -n mise/tasks/release/package-xcframework.sh
• Not run: full Apple notarization flow, because that submits a release artifact to Apple.

No GitHub comments yet.