Release script: Sandbox macOS builds

[kit-ty-kate]

Currently the macOS builds are the only one that are not sandboxed and are built on the host, one solution that I’ve tested would be to use https://github.com/cirruslabs/tart/ which provides ready macos images ran using Apple’s Virtualization.Framework.

Build steps tested:

• brew install cirruslabs/cli/tart
• tart clone ghcr.io/cirruslabs/macos-sonoma-xcode:latest macos-14 (sources for the base images are located at https://github.com/cirruslabs/macos-image-templates)
• tart run macos-14
• scp -o StrictHostKeyChecking=no opam-full-<version>.tar.gz admin@$(tart ip macos-14): (password: admin)
• untar, cd, make cold

The major inconvenient is that the base image is 54GB (110GB if we do a copy before a run for reproducibility) which adds to the already required 60GB added by the Windows image in #5789. I personally do not have the necessary space to store this. Even the vanilla image with nothing installed would require 55GB