fix(macho): preserve subtype labels across dylib consumers

docs/native-investigation.md

@@ -515,11 +515,11 @@ their failure outcome.
 and its `container_file_offset` in the input file. A thin Mach-O has a known
 offset of zero; an unknown universal-slice offset stays null. The Evidence
 subject format describes the input container: `mach-o-universal` for FAT files,
-including those with one slice. The normalized result describes the selected
-Mach-O image. Architecture
-`file_offset` values are container-relative. Entrypoint, segment and section
-`file_offset` values retain their source meaning and are relative to the
-selected Mach-O slice. Raw load-command fields retain their original values.
+including those with one slice. The normalized result also reports the container
+in `format`; `selected_architecture` identifies the selected Mach-O image.
+Architecture `file_offset` values are container-relative. Entrypoint, segment
+and section `file_offset` values retain their source meaning and are relative
+to the selected Mach-O slice. Raw load-command fields retain their original values.
 A field otool prints more than once, such as each `LC_BUILD_VERSION` tool, is
 keyed `name #n` in print order. Each `LC_LINKER_OPTION` string is keyed
 `string #n` and checked against the declared `count`. Evidence locations map the LC_MAIN entrypoint and nonempty file-backed segment
@@ -556,6 +556,10 @@ complete observation.
   its outcome. Paths outside the analyzed root, including shared-cache system
   libraries, stay undetermined. See
   [Apple application analysis](apple-application-analysis.md#dylib-load-resolution).
+  ARM64 slice labels distinguish `arm64v8`, `arm64e`, and `arm64e.x1` while
+  retaining raw CPU subtype and capability bits. The `arm64` and `arm64e`
+  request filters select their respective families; a shared family label
+  does not establish dependency compatibility across different subtypes.
   Executable-root discovery preserves traversal uncertainty, including
   undecodable filenames and skipped symlinks, as partial coverage. Known
   executable roots remain available; unexamined names and symlink targets