test(ci): complete the macOS 3.5.0 matrix with both root legs

[oferchen]

Completes the upstream 3.5.0 testsuite matrix on macOS and consolidates the
duplication that adding the legs would otherwise have created.

Stacked on #7691. Until that merges this PR's diff shows its commit too.

Coverage

	pipe nonroot	pipe root	tcp nonroot	tcp root
Linux	required	required	required	required
macOS	non-required	this PR	#7691	this PR

Why the privilege axis is not redundant with Linux

Crossing the committed Linux manifests puts ~29 cells in the set a macOS
root leg would newly RUN. They are not the chown/devices cells the workflow
header used to assume — the set is dominated by the symlink-race and
confinement family: backup-dir-symlink-race, symlink-race-dest,
temp-dir-symlink-injection, daemon-module-chdir-symlink,
operator-path-backup-symlink, and all five chroot-*-inner-module.

Those are exactly the cells whose Linux passes are known to rest on Landlock
rather than on the userspace confinement guard — that guard was measured failing
on both platforms under a symlinked ancestor. macOS has no Landlock, so it is
the only place the guard is exercised unaided.

⚠ The ~29 is a prediction, and ships as one

Neither leg names a manifest. Each runs the whole corpus and emits its own via
EMIT_EXPECT_RESULT as an artifact, so the manifests come from an executed run
of the leg they describe.

That is deliberate: the same prediction for the macOS tcp leg said 52 cells
and the executed run gave 32, because cells skip on macOS for platform
reasons the Linux manifests cannot express. Until the manifests are committed
these two checks report the suite's genuine result — which on a suite with known
divergences means red. Both are non-required, matching the macOS pipe leg.

No new caller job — and that was a correction

variant defaults to all, so the two existing macOS callers each publish
both legs. This mirrors _upstream-testsuite.yml, whose callers pass no
variant at all.

The first version of this change added a caller per privilege leg with
variant: 'root' pinned. That works, but a caller pinned to one variant makes
the reusable workflow's other job report a permanently SKIPPED check —
four of them across the two transports, which
check_pr_check_name_uniqueness.py confirmed by counting 84 names instead
of 80. Skipped checks nobody can act on are noise, and the Linux idiom already
avoided them. Corrected before landing; the lint is back to 80.

Consolidation — otherwise this would add two more copies

The nonroot and root legs differ only in the sudo re-exec and their output
paths. Six setup steps and a ~60-line summary renderer are identical, and the
Linux workflow already carries two divergent copies of its own preamble.

• .github/actions/upstream-testsuite-macos-setup — the shared setup steps.
  Checkout stays in the caller: a local uses: action cannot check out the tree
  it is loaded from.
• tools/ci/summarize_upstream_testsuite.sh — the summary renderer. Exits 0
  on a missing log on purpose: it runs under if: always() after a step that may
  have failed, and the job's conclusion must stay the testsuite's.

A new job and its full setup now costs 4 lines of YAML instead of ~190.

Verification

• The extraction was scripted, and the script asserts every non-trivial line
  of the removed block survives in the action. 120 of 129 moved verbatim; the
  9 it flagged are exactly the intended parameterisation (three env.*→
  inputs.*, the rust-cache key, and the reworded cache-key comment).
• That comment is load-bearing and moved with its code: the upstream-source
  cache key hashes the file supplying CPPFLAGS/LDFLAGS, because
  run_upstream_testsuite.sh skips ./configure when shconfig is present —
  a tree cached under a different flag set would be reused with its original
  feature set and no step would notice. The flags now live in the action, so the
  key hashes the action too.
• Workflows verified by parsing the written YAML, not re-reading the intended
  edit. Confirms two jobs, correct if: guards, and that artifact names, emitted
  manifest paths and rust-cache keys are all pairwise distinct — each is a
  per-run namespace, so a collision would let one leg silently overwrite
  another's outcomes. It also asserts every composite run: step declares
  shell:, without which the action fails to load naming no step.
• Summariser exercised against a synthetic log with PASS/FAIL/UPASS/SKIP/XFAIL
  rows: correct sections, exit 0.
• check_pr_check_name_uniqueness.py: 80 names, one publisher each.
  run_tools_tests.sh: 86 passed, exit 0.

Follow-up

Once both manifests land from these runs, the residual consolidation is the
Linux workflow's own two copies of the same preamble and summary block — it can
adopt both shared pieces without changing any required check context.