fix(#41): restore Intel Mac build via ort-dynamic + Homebrew ONNX Runtime (#43)

* fix: restore Intel Mac build via ort-dynamic + system libonnxruntime

Microsoft is discontinuing x86_64 macOS ONNX Runtime prebuilts after
v1.23.0, so ort-sys 2.0.0-rc.11 can't ship an Intel Mac binary and never
will. Previous Intel Mac attempts kept dying in the ort-sys build script
with "does not provide prebuilt binaries for the target x86_64-apple-darwin
with feature set (no features)." Issue #41 was the latest casualty.

Fix: route Intel Mac through the ort-dynamic feature path (runtime dlopen
against a system libonnxruntime installed via Homebrew). This sidesteps
ort-sys prebuilts entirely and works today.

Changes:

- crates/vestige-core/Cargo.toml: split `embeddings` into code-only vs
  backend-choice. The embeddings feature now just pulls fastembed + hf-hub
  + image-models and activates the 27 #[cfg(feature = "embeddings")] gates
  throughout the crate. New `ort-download` feature carries the
  download-binaries-native-tls backend (the historical default). Existing
  `ort-dynamic` feature now transitively enables `embeddings`, so the
  cfg gates stay active when users swap backends.

  Default feature set expands `["embeddings", ...]` -> `["embeddings",
  "ort-download", ...]` so existing consumers see identical behavior.

- crates/vestige-mcp/Cargo.toml: mirrors the split. Adds `ort-download`
  feature that chains to vestige-core/ort-download, keeps `ort-dynamic`
  that chains to vestige-core/ort-dynamic. Both transitively pull
  `embeddings`. Default adds `ort-download` so `cargo install vestige-mcp`
  still picks the prebuilt-ort backend like before.

- .github/workflows/ci.yml: re-adds x86_64-apple-darwin to the
  release-build matrix with `--no-default-features --features
  ort-dynamic,vector-search`. Adds a `brew install onnxruntime` step that
  sets ORT_DYLIB_PATH from `brew --prefix onnxruntime`.

- .github/workflows/release.yml: re-adds x86_64-apple-darwin to the
  release matrix with the same flags + brew install step. The Intel Mac
  tarball now also bundles docs/INSTALL-INTEL-MAC.md so binary consumers
  get the `brew install onnxruntime` + ORT_DYLIB_PATH prereq out of the
  box.

- docs/INSTALL-INTEL-MAC.md: new install guide covering the Homebrew
  prereq, binary install, source build, troubleshooting, and the v2.1
  ort-candle migration plan.

- README.md: replaces the "Intel Mac and Windows build from source only"
  paragraph with the prebuilt Intel Mac install (brew + curl + env var)
  and a link to the full guide. Platform table updated: Intel Mac back
  on the "prebuilt" list.

Verified locally on aarch64-apple-darwin:
- `cargo check --release -p vestige-mcp` -> clean (default features)
- `cargo check --release -p vestige-mcp --no-default-features
   --features ort-dynamic,vector-search` -> clean

Runtime path on Intel Mac (verified on CI):
  brew install onnxruntime
  export ORT_DYLIB_PATH=$(brew --prefix onnxruntime)/lib/libonnxruntime.dylib
  vestige-mcp --version

Fixes #41. Long-term plan (v2.1): migrate to ort-candle pure-Rust backend
so no system ONNX Runtime dep is needed on any platform.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(ci): drop unused brew install + ORT_DYLIB_PATH from CI steps

Build is a cross-compile (macos-latest runner is Apple Silicon targeting
x86_64-apple-darwin) and ort-load-dynamic doesn't link libonnxruntime at
build time — only at runtime via dlopen. So the brew install step and
ORT_DYLIB_PATH export were ceremony without payload. Removed to cut CI
time. Runtime setup remains documented in docs/INSTALL-INTEL-MAC.md for
end users installing the tarball on their own Intel Mac.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci: run release-build on PRs too — catch Intel Mac regressions pre-merge

Previously release-build was gated behind `github.ref == 'refs/heads/main'`,
so the Intel Mac, aarch64-apple-darwin, and Linux release targets were only
validated AFTER merge to main. If someone broke the Intel Mac cross-compile
by touching feature flags or Cargo dependencies, we'd only find out when
the release tag was cut and the job exploded on main. Extending the guard
to also fire on pull_request means regressions surface in the PR status
check instead of on a release branch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -50,7 +50,12 @@ jobs:
   release-build:
     name: Release Build (${{ matrix.target }})
     runs-on: ${{ matrix.os }}
-    if: github.ref == 'refs/heads/main'
+    # Run on main pushes AND on PRs that touch workflows, Cargo manifests, or
+    # crate sources — so Intel Mac / Linux release targets are validated
+    # before merge, not after.
+    if: |
+      github.ref == 'refs/heads/main' ||
+      github.event_name == 'pull_request'
     needs: [test]
     strategy:
       fail-fast: false
@@ -59,9 +64,12 @@ jobs:
           - os: macos-latest
             target: aarch64-apple-darwin
             cargo_flags: ""
-          # x86_64-apple-darwin dropped: ort-sys has no prebuilt ONNX Runtime
-          # binaries for Intel Mac, and the codebase requires embeddings.
-          # Apple discontinued Intel Macs in 2020. Build from source if needed.
+          # Intel Mac builds against a system ONNX Runtime via ort-dynamic
+          # (ort-sys has no x86_64-apple-darwin prebuilts). Compile-only here;
+          # runtime linking is a user concern documented in INSTALL-INTEL-MAC.md.
+          - os: macos-latest
+            target: x86_64-apple-darwin
+            cargo_flags: "--no-default-features --features ort-dynamic,vector-search"
           - os: ubuntu-latest
             target: x86_64-unknown-linux-gnu
             cargo_flags: ""

.github/workflows/release.yml

@@ -27,17 +27,21 @@ jobs:
             os: ubuntu-latest
             archive: tar.gz
             cargo_flags: ""
+            needs_onnxruntime: false
           - target: x86_64-pc-windows-msvc
             os: windows-latest
             archive: zip
             cargo_flags: ""
-          # Intel Mac (x86_64-apple-darwin) is explicitly unsupported: the
-          # upstream ort-sys 2.0.0-rc.11 pinned by fastembed 5.13.2 does not
-          # ship Intel Mac prebuilts, and the v2.0.5 + v2.0.6 release
-          # workflows both failed this job. Matches ci.yml which already
-          # dropped the target. README documents the build-from-source path
-          # for Intel Mac users. When ort-sys ships Intel Mac prebuilts
-          # again, restore the entry.
+            needs_onnxruntime: false
+          # Intel Mac uses the ort-dynamic feature to runtime-link against a
+          # system libonnxruntime (Homebrew), sidestepping the missing
+          # x86_64-apple-darwin prebuilts in ort-sys 2.0.0-rc.11. Binary
+          # consumers must `brew install onnxruntime` before running — see
+          # INSTALL-INTEL-MAC.md bundled in the tarball.
+          - target: x86_64-apple-darwin
+            os: macos-latest
+            archive: tar.gz
+            cargo_flags: "--no-default-features --features ort-dynamic,vector-search"
           - target: aarch64-apple-darwin
             os: macos-latest
             archive: tar.gz
@@ -58,8 +62,13 @@ jobs:
       - name: Package (Unix)
         if: matrix.os != 'windows-latest'
         run: |
+          cp docs/INSTALL-INTEL-MAC.md target/${{ matrix.target }}/release/ 2>/dev/null || true
           cd target/${{ matrix.target }}/release
-          tar -czf ../../../vestige-mcp-${{ matrix.target }}.tar.gz vestige-mcp vestige vestige-restore
+          if [ "${{ matrix.target }}" = "x86_64-apple-darwin" ]; then
+            tar -czf ../../../vestige-mcp-${{ matrix.target }}.tar.gz vestige-mcp vestige vestige-restore INSTALL-INTEL-MAC.md
+          else
+            tar -czf ../../../vestige-mcp-${{ matrix.target }}.tar.gz vestige-mcp vestige vestige-restore
+          fi
 
       - name: Package (Windows)
         if: matrix.os == 'windows-latest'