chore: import upstream snapshot with attribution

scripts/verify-macho-readonly.sh

@@ -0,0 +1,51 @@
+#!/bin/sh
+# Smoke test for the macOS __DATA_CONST regression (issue #176).
+#
+# macOS 15 Sequoia and 26 Tahoe's dyld ABORT a process at load time if the
+# __DATA_CONST segment is missing the SG_READ_ONLY (0x10) segment flag:
+#
+#   dyld: __DATA_CONST segment missing SG_READ_ONLY flag in <binary>
+#
+# Apple's native linker (ld-prime) sets that flag; the osxcross/cctools ld64
+# used by goreleaser-cross did not — so a cross-compiled cask shipped broken
+# while every locally `go build`-ed binary worked. This guard fails the
+# release if a darwin binary is produced without the flag, so the broken
+# shape can never ship again.
+#
+# Usage: verify-macho-readonly.sh <mach-o-binary>
+set -eu
+
+bin="${1:?usage: verify-macho-readonly.sh <mach-o-binary>}"
+[ -f "$bin" ] || { echo "FATAL: $bin does not exist" >&2; exit 1; }
+
+# Pull the SEGMENT-level flags for __DATA_CONST out of `otool -l`. A segment
+# block is "cmd LC_SEGMENT_64 ... segname __DATA_CONST ... flags 0xNN"; the
+# section sub-blocks that follow also carry a segname field, so we capture the
+# FIRST flags line after the segment's segname and stop — that is the segment
+# command's flags, not a section's.
+flags="$(otool -l "$bin" | awk '
+  /^Load command/                                    { inseg=0; seg="" }
+  $1=="cmd" && ($2=="LC_SEGMENT_64" || $2=="LC_SEGMENT") { inseg=1 }
+  inseg && $1=="segname" && seg==""                  { seg=$2 }
+  inseg && $1=="flags" && seg=="__DATA_CONST"        { print $2; exit }
+')"
+
+if [ -z "$flags" ]; then
+  echo "FATAL: no __DATA_CONST segment found in $bin (is it a Mach-O?)" >&2
+  exit 1
+fi
+
+# otool prints segment flags as hex (e.g. 0x10 / 0x00000010); some builds
+# render the symbolic name. Accept either form.
+case "$flags" in
+  *READ_ONLY*) echo "ok: $bin __DATA_CONST carries SG_READ_ONLY ($flags)"; exit 0 ;;
+esac
+
+# Shell arithmetic understands the 0x prefix; SG_READ_ONLY is 0x10.
+if [ $(( flags & 0x10 )) -eq 0 ]; then
+  echo "FATAL: $bin __DATA_CONST flags=$flags missing SG_READ_ONLY (0x10)." >&2
+  echo "       This binary would abort under the macOS 15+/Tahoe dyld (issue #176)." >&2
+  exit 1
+fi
+
+echo "ok: $bin __DATA_CONST carries SG_READ_ONLY (flags=$flags)"