fix(nodejs): resolve OpenSSL through macOS rpaths

[100yenadmin]

Summary

• rewrite macOS Node addon OpenSSL dependencies to @rpath
• search the standard Homebrew ARM, Homebrew Intel, and MacPorts OpenSSL roots
• verify the packaged Mach-O dependencies and load the relocated addon in CI

Root cause

The published macOS Node addons inherit absolute install names from the OpenSSL
dylibs available on the build runner. Current artifacts therefore reference
/opt/homebrew/opt/openssl@3/... directly and fail to load for MacPorts users
even when a maintained OpenSSL 3 installation is present at /opt/local/lib.

Security and packaging

This does not bundle or statically link OpenSSL. Consumers still provide a
separately maintained OpenSSL 3 installation. The packaging step replaces the
build-machine-specific dependency names with @rpath and embeds only these
search roots:

• /opt/homebrew/opt/openssl@3/lib
• /usr/local/opt/openssl@3/lib
• /opt/local/lib

The modified addon is ad-hoc signed after install_name_tool changes it.

Validation

• verifier failed against the published 0.18.1 addon before relocation
• relocation and verification pass on a fresh copy of that addon
• relocation is idempotent when run twice
• the relocated addon loads successfully through Node.js
• bash -n and ShellCheck pass for both scripts
• git diff --check passes
• the workflow runs relocation, Mach-O verification, and addon loading on both
  macOS matrix entries before artifact upload

Full macOS ARM and Intel build proof remains delegated to this PR's remote CI.

Closes #681

[100yenadmin]

Validation note for maintainers: the ordinary PR checks do not invoke .github/workflows/nodejs-workflow.yml; that workflow is dispatch/reuse-only and requires a precompiled-run artifact ID.

Local packaging proof is included in the PR body and is green. Before marking this ready, the downstream reconciliation gate still requires the authoritative macOS ARM and Intel Node artifact jobs. Please advise the preferred maintainer-dispatch route for this fork PR, or dispatch the equivalent no-publish build after reviewing the workflow change. No npm publication is requested.

[100yenadmin]

Authoritative artifact proof is now complete.

• Precompiled matrix at PR head d61f8590d2ee7d27a7f72bea22d268e3c55bfe4f: 8/8 green, including macOS ARM and Intel
  • https://github.com/100yenadmin/ladybug/actions/runs/29227829393
• Node matrix: 5/5 green, including macOS ARM and Intel relocation, Mach-O verification, native load/tests, and artifact upload
  • https://github.com/100yenadmin/ladybug/actions/runs/29230524989

The Node run uses evidence-only commit b4ca280b, whose sole difference from this PR head is one workflow environment line selecting the fork as the artifact source. That line is not part of this PR. The underlying fork-dispatch defect is tracked separately in #683.

No package was published and no deployment occurred. With ordinary PR checks and both artifact matrices green, this PR is ready for maintainer review.

[100yenadmin]

@coderabbitai review

[100yenadmin]

Additional Homebrew-independence proof is green:

• https://github.com/100yenadmin/ladybug/actions/runs/29231227559
• 5/5 jobs passed.
• Both macOS ARM and Intel completed relocation and verification.
• Each macOS job copied OpenSSL to /opt/local/lib, hid the Homebrew copies,
  started a fresh Node process, loaded the addon, ran tests, and restored the
  runner state.

The additional probe exists only on evidence branch commit a2862f27; PR
#682 remains unchanged at d61f8590. All ordinary fork workflows were
disabled again after the run, and no package or deployment action occurred.