fix(build): make macOS release builds work natively

The --mac-release path (full-node and --lite-backend) had never run on a real
Mac and broke on several Linux-only assumptions:

- build.sh version parser used GNU sed \+ (BSD sed reads it literally), so it
  aborted before compiling — switched to POSIX [[:space:]][[:space:]]*.
- build.sh libsodium universal check used GNU grep \| — switched to grep -E.
- libwebp's cpu.cmake applies -mno-sse2 to its reference DSP files; under a
  universal build (-arch arm64;x86_64) that lands on the x86_64 slice, where it
  disables _Float16 and breaks the SDK 26 <math.h>. Added an idempotent
  FetchContent PATCH_COMMAND (cmake/patch-libwebp-simd.cmake) to neutralize it.
- The SDXL lite backend static lib needs Security + CoreFoundation frameworks on
  macOS; added them to the imported dragonx_lite_backend target for APPLE.
- Added a DRAGONX_MAC_ARCHS override plus auto-detect: with --lite-backend the
  app is built for the arch(es) the backend .a actually provides (its pinned
  ring 0.16.11 is x86_64-only), instead of failing to link a universal app.
- build-lite-backend-artifact.sh uses bash 4+ (mapfile); added a re-exec guard
  for macOS's stock bash 3.2 and added bash to setup.sh's macOS core deps.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CMakeLists.txt

@@ -136,6 +136,13 @@ if(DRAGONX_ENABLE_LITE_BACKEND)
     set_target_properties(dragonx_lite_backend PROPERTIES
         IMPORTED_LOCATION "${DRAGONX_LITE_BACKEND_LIBRARY}"
     )
+    if(APPLE)
+        # The Rust backend's TLS stack (security-framework / core-foundation crates)
+        # references Secure Transport (SSL*) + CoreFoundation symbols. Link the frameworks
+        # that provide them, or the static lib leaves ~130 symbols undefined at link time.
+        set_property(TARGET dragonx_lite_backend APPEND PROPERTY
+            INTERFACE_LINK_LIBRARIES "-framework Security" "-framework CoreFoundation")
+    endif()
     if(DRAGONX_LITE_BACKEND_INCLUDE_DIR)
         if(NOT IS_DIRECTORY "${DRAGONX_LITE_BACKEND_INCLUDE_DIR}")
             message(FATAL_ERROR "DRAGONX_LITE_BACKEND_INCLUDE_DIR does not exist: ${DRAGONX_LITE_BACKEND_INCLUDE_DIR}")
@@ -284,6 +291,15 @@ FetchContent_Declare(
     GIT_REPOSITORY https://github.com/webmproject/libwebp.git
     GIT_TAG v1.4.0
     GIT_SHALLOW TRUE
+    # libwebp's cpu.cmake applies -mno-sse2/-mno-sse4.1 to its scalar reference DSP
+    # files when it can't probe SSE support. Under a macOS universal build
+    # (-arch arm64;x86_64) that probe fails, so the flags land on the x86_64 slice,
+    # where -mno-sse2 disables _Float16 and breaks the SDK's <math.h>. Neutralize
+    # those disable flags (SSE2 is x86_64 baseline). Portable + idempotent; a no-op
+    # for single-arch Linux/Windows/x86_64 builds. See cmake/patch-libwebp-simd.cmake.
+    PATCH_COMMAND ${CMAKE_COMMAND}
+        -DCPU_CMAKE=<SOURCE_DIR>/cmake/cpu.cmake
+        -P ${CMAKE_CURRENT_SOURCE_DIR}/cmake/patch-libwebp-simd.cmake
 )
 set(WEBP_LINK_STATIC ON CACHE BOOL "" FORCE)
 set(WEBP_BUILD_ANIM_UTILS OFF CACHE BOOL "" FORCE)