fix: scan all Mach-O binaries for bundle linkage, not just .so/.dylib (#10189)

_verify_bundle_linkage's host-library scan only matched files by
.so/.dylib name suffix, so a shipped executable (Contents/MacOS/*)
or a Python.framework payload with a host-linked dependency but no
matching suffix could slip through unchecked — the same class of
bug #10135 was added to catch.

Detect Mach-O executables/libraries by content via `file` instead
(same pattern the codesign step in this file already uses),
regardless of extension or executable permission bits, so readable
non-executable dylibs are covered too.

pkg/mac/build-functions.sh

@@ -515,7 +515,10 @@ _verify_bundle_linkage() {
         echo "ERROR: ${f} links against build-host libraries:" >&2
         echo "${deps}" | sed 's/^/    /' >&2
         found="yes"
-    done < <(find "${BUNDLE_DIR}" \( -name '*.so' -o -name '*.dylib' \) -type f)
+    done < <(find "${BUNDLE_DIR}" -type f -exec file "{}" \; | \
+        grep -v "(for architecture" | \
+        grep -E "Mach-O executable|Mach-O 64-bit executable|Mach-O 64-bit bundle|Mach-O 64-bit dynamically linked shared library" | \
+        awk -F":" '{print $1}' | uniq)
 
     if [ -n "${found}" ]; then
         echo "ERROR: the bundle links against libraries outside it; those paths" >&2