build: add macOS (Apple Silicon) build support

macOS compiles the existing POSIX/Linux code paths (KYTY_PLATFORM_LINUX)
targeting x86_64 under Rosetta 2. Adds an APPLE branch to the build:
selects Apple's ld64 linker, unsets the Ninja response-file forcing (Apple
ar has no @file support), derives the target arch from CMAKE_OSX_ARCHITECTURES
for cpuinfo/ffmpeg, and re-signs the binary post-build with JIT entitlements
(required to execute written trampolines and Rosetta-translated guest code).

All changes are guarded by if(APPLE); Windows and Linux configuration is
unchanged.

(cherry picked from commit 13be13b7573b9a687cf87531a81e4497ed3de1d5)

src/CMakeLists.txt

@@ -10,8 +10,8 @@ if(CMAKE_SYSTEM_NAME MATCHES ".*Linux")
 	set(LINUX TRUE)
 endif()
 
-if (NOT (WIN32 OR LINUX))
-    message(FATAL_ERROR "only Windows and Linux builds are supported")
+if (NOT (WIN32 OR LINUX OR APPLE))
+    message(FATAL_ERROR "only Windows, Linux, and macOS builds are supported")
 endif()
 
 set(CMAKE_CXX_STANDARD 20)
@@ -45,8 +45,9 @@ else()
 	set(KYTY_BUILD KYTY_BUILD_RELEASE)
 endif()
 
-if(LINUX)
-	set(KYTY_PLATFORM KYTY_PLATFORM_LINUX)	
+if(LINUX OR APPLE)
+	# macOS rides the POSIX/Linux code paths until it gets a dedicated platform
+	set(KYTY_PLATFORM KYTY_PLATFORM_LINUX)
 else()
 	set(KYTY_PLATFORM KYTY_PLATFORM_WINDOWS)
 endif()
@@ -63,6 +64,8 @@ if(CMAKE_CXX_COMPILER_ID MATCHES "^(Apple)?Clang$")
 	if(WIN32 AND KYTY_CXX_COMPILER_NAME STREQUAL "clang-cl")
 		set(KYTY_CLANG_CL TRUE)
 		set(KYTY_LINKER LLD_LINK)
+	elseif(APPLE)
+		set(KYTY_LINKER LD64) # Apple's default linker; lld flags don't apply
 	else()
 		set(KYTY_LINKER LLD)
 	endif()
@@ -461,6 +464,18 @@ endif()
 
 add_dependencies(kyty_emulator KytyGitVersion)
 
+if(APPLE)
+	# The emulator writes x86-64 trampolines/PLT stubs into memory and executes them, and
+	# runs guest code under Rosetta. That requires the JIT / unsigned-executable-memory
+	# entitlements, so re-sign the binary after every link (an unsigned/relinked binary
+	# reverts to the hardened defaults and aborts when it first executes written code).
+	add_custom_command(TARGET kyty_emulator POST_BUILD
+		COMMAND codesign -s - --force --options runtime
+			--entitlements "${CMAKE_CURRENT_SOURCE_DIR}/macos_jit.entitlements"
+			$<TARGET_FILE:kyty_emulator>
+		COMMENT "Codesign kyty_emulator with JIT entitlements (macOS)")
+endif()
+
 install(TARGETS kyty_emulator DESTINATION .)
 if(KYTY_BUILD_LAUNCHER)
 	add_subdirectory(launcher)

src/macos_jit.entitlements

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-executable-page-protection</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+</dict>
+</plist>

src/utils.cmake

@@ -68,7 +68,15 @@ set(KYTY_WARNINGS_ARE_ERRORS OFF)
 set(KYTY_C_FLAGS "")
 set(KYTY_CPP_FLAGS "")
 
-SET(CMAKE_NINJA_FORCE_RESPONSE_FILE 1 CACHE INTERNAL "")
+# Apple's /usr/bin/ar does not understand @response-file syntax, and macOS has a
+# large ARG_MAX so response files aren't needed. Note: the Ninja generator forces a
+# response file whenever CMAKE_NINJA_FORCE_RESPONSE_FILE is *defined* (it tests
+# definedness, not the value), so on Apple it must be fully unset, not set to 0.
+if(APPLE)
+	unset(CMAKE_NINJA_FORCE_RESPONSE_FILE CACHE)
+else()
+	SET(CMAKE_NINJA_FORCE_RESPONSE_FILE 1 CACHE INTERNAL "")
+endif()
 
 if(KYTY_CLANG_CL)
 	if(CMAKE_CXX_FLAGS MATCHES "/W[0-4]")