WIP: ci: enable macOS-15 build

[gmarzot]

WIP — do not merge yet. Depends on facebookexperimental/moxygen#162 syncing into openmoq/moxygen main.

What this does

Enables the macOS-15 (Apple Silicon) build job in both `ci-pr.yml` and `ci-main.yml`. The matrix entry was previously commented out with the comment "moxygen tarball bakes brew Cellar versioned paths that break when the runner has different brew package versions" — that's the issue addressed by facebookexperimental/moxygen#162.

Bumps `deps/moxygen` submodule to `2540d9e9` on branch `fix/macos-openssl-stable-path-omoq` (a temporary openmoq-side carry of the same patch). CI's three-mode setup detects the off-main SHA and auto-falls back to source build, so the macOS job builds moxygen from the patched branch rather than the (broken) snapshot tarball.

Why this is WIP

1. The moxygen submodule pointer is on a temporary fix branch, not main. Once standalone: steer OpenSSL through brew opt-symlink on macOS facebookexperimental/moxygen#162 lands and syncs into openmoq/moxygen main, we revert the submodule bump and the openmoq-side carry branch can be deleted.
2. macOS source build is slow (~15-30 min) — when the upstream fix is in tarballs, we get fast tarball mode for free.

Testing so far

Verified end-to-end on argo (macOS Apple Silicon, M-series):

• `bash scripts/build.sh setup` — auto-detects off-main submodule SHA, prints actionable error, falls back to source build:
  ```
  ==> Moxygen submodule SHA: 2540d9e
  ==> Snapshot release SHA: 9f6bee4
  Error: snapshot-latest does not match the moxygen submodule pin.
  Release artifacts not available — falling back to source build...
  ```
• moxygen builds from source against the patched submodule
• Install tree contains stable opt-symlink paths only — no openssl@3 Cellar references:
  ```
  $ grep -rE 'Cellar/openssl@3' .scratch/moxygen-install/lib/cmake/
  (empty)
  $ grep -rE 'opt/openssl@3' .scratch/moxygen-install/lib/cmake/ | head
  fizz/fizz-targets.cmake: .../opt/openssl@3/lib/libssl.dylib...
  folly/folly-targets.cmake: .../opt/openssl@3/include...
  ```
• moqx builds successfully against this install tree

Scope

• `build` job only (matrix entry on macOS-15)
• Conformance for macOS: deferred to follow-up (matrix is currently linux-only; refactor needed)
• Publish for macOS: deferred to follow-up (Docker doesn't make sense; need to decide standalone-tarball strategy)

Path to merge

1. standalone: steer OpenSSL through brew opt-symlink on macOS facebookexperimental/moxygen#162 reviewed and merged
2. openmoq/moxygen daily upstream-sync workflow brings the patch into main
3. Drop the submodule bump in this PR (revert to a current-main SHA)
4. Drop `WIP:` prefix
5. Merge

```
Closes openmoq/moxygen carry branch 'fix/macos-openssl-stable-path-omoq'.
```

---

This change is