build: macOS universal binary (arm64+x86_64) with deployment target 11.0

- Set CMAKE_OSX_DEPLOYMENT_TARGET and CMAKE_OSX_ARCHITECTURES before
  project() so they propagate to all FetchContent dependencies (SDL3, etc.)
- build.sh: native mac release builds universal binary, detects and
  rebuilds single-arch libsodium, verifies with lipo, exports
  MACOSX_DEPLOYMENT_TARGET; dev build uses correct build/mac directory
- fetch-libsodium.sh: build arm64 and x86_64 separately then merge with
  lipo on native macOS; fix sha256sum unavailable on macOS (use shasum)

scripts/fetch-libsodium.sh

@@ -50,12 +50,20 @@ if [[ ! -f "$TARBALL" ]]; then
     curl -fSL -o "$TARBALL" "$SODIUM_URL"
 fi
 
-# Verify checksum
-echo "$SODIUM_SHA256  $TARBALL" | sha256sum -c - || {
-    echo "[fetch-libsodium] ERROR: SHA256 mismatch! Removing corrupted download."
-    rm -f "$TARBALL"
-    exit 1
-}
+# Verify checksum (sha256sum on Linux, shasum on macOS)
+if command -v sha256sum &>/dev/null; then
+    echo "$SODIUM_SHA256  $TARBALL" | sha256sum -c - || {
+        echo "[fetch-libsodium] ERROR: SHA256 mismatch! Removing corrupted download."
+        rm -f "$TARBALL"
+        exit 1
+    }
+elif command -v shasum &>/dev/null; then
+    echo "$SODIUM_SHA256  $TARBALL" | shasum -a 256 -c - || {
+        echo "[fetch-libsodium] ERROR: SHA256 mismatch! Removing corrupted download."
+        rm -f "$TARBALL"
+        exit 1
+    }
+fi
 
 # ── Extract ─────────────────────────────────────────────────────────────────
 if [[ ! -d "$SRC_DIR" ]]; then
@@ -115,6 +123,69 @@ case "$TARGET" in
         ;;
 esac
 
+# ── Native macOS: build universal binary (arm64 + x86_64) ───────────────────
+IS_MACOS_NATIVE=false
+if [[ "$TARGET" == "native" && "$(uname -s)" == "Darwin" ]]; then
+    IS_MACOS_NATIVE=true
+fi
+
+if $IS_MACOS_NATIVE; then
+    echo "[fetch-libsodium] Building universal (arm64 + x86_64) for macOS..."
+    export MACOSX_DEPLOYMENT_TARGET="11.0"
+
+    INSTALL_ARM64="$PROJECT_DIR/libs/libsodium-arm64"
+    INSTALL_X86_64="$PROJECT_DIR/libs/libsodium-x86_64"
+
+    for ARCH in arm64 x86_64; do
+        echo "[fetch-libsodium] Building for $ARCH..."
+        cd "$SRC_DIR"
+        make clean 2>/dev/null || true
+        make distclean 2>/dev/null || true
+
+        if [[ "$ARCH" == "arm64" ]]; then
+            ARCH_INSTALL="$INSTALL_ARM64"
+            HOST_TRIPLE="aarch64-apple-darwin"
+        else
+            ARCH_INSTALL="$INSTALL_X86_64"
+            HOST_TRIPLE="x86_64-apple-darwin"
+        fi
+
+        ARCH_CFLAGS="-arch $ARCH -mmacosx-version-min=11.0"
+
+        ./configure \
+            --prefix="$ARCH_INSTALL" \
+            --disable-shared \
+            --enable-static \
+            --with-pic \
+            --host="$HOST_TRIPLE" \
+            CFLAGS="$ARCH_CFLAGS" \
+            LDFLAGS="-arch $ARCH" \
+            > /dev/null
+
+        make -j"$(sysctl -n hw.ncpu 2>/dev/null || echo 4)" > /dev/null 2>&1
+        make install > /dev/null
+    done
+
+    # Merge with lipo
+    echo "[fetch-libsodium] Creating universal binary with lipo..."
+    mkdir -p "$INSTALL_DIR/lib" "$INSTALL_DIR/include"
+    lipo -create \
+        "$INSTALL_ARM64/lib/libsodium.a" \
+        "$INSTALL_X86_64/lib/libsodium.a" \
+        -output "$INSTALL_DIR/lib/libsodium.a"
+    cp -R "$INSTALL_ARM64/include/"* "$INSTALL_DIR/include/"
+
+    # Clean up per-arch builds
+    rm -rf "$INSTALL_ARM64" "$INSTALL_X86_64"
+    cd "$PROJECT_DIR"
+    rm -rf "$SRC_DIR"
+    rm -f "$TARBALL"
+
+    echo "[fetch-libsodium] Done (universal): $INSTALL_DIR/lib/libsodium.a"
+    lipo -info "$INSTALL_DIR/lib/libsodium.a"
+    exit 0
+fi
+
 echo "[fetch-libsodium] Configuring for target: $TARGET ..."
 ./configure "${CONFIGURE_ARGS[@]}" > /dev/null