fix(native): preserve universal Mach-O container identity

Keep FAT container format distinct from selected slice architecture through target admission, Evidence, snapshots, and CLI/MCP lifecycle results. Preserve native, Hopper, Ghidra, extraction, and dylib routing for the Mach-O family.

Reject selected FAT ranges overlapping their table or too short for a Mach-O header. Replace empty-slice fixtures with in-bounds executable headers and cover thin, universal, single-slice, FAT64, and swapped containers.

Validation: static and architecture checks, generated docs, targeted producer and public MCP tests. Provider routing uses controlled fixtures; no live Hopper, IDA, JADX, or Ghidra analysis was performed for this change.

src/domain/binaryTargetTypes.ts

@@ -83,7 +83,12 @@ export type BinaryTarget =
       readonly managed?: never;
     })
   | (ExecutableTarget & {
-      readonly format: "mach-o" | "elf" | "dos-mz" | "dos-com";
+      readonly format:
+        | "mach-o"
+        | "mach-o-universal"
+        | "elf"
+        | "dos-mz"
+        | "dos-com";
       readonly executableRole?: never;
       readonly managed?: never;
     })
@@ -130,3 +135,9 @@ export type BinaryTarget =
         readonly kind: "artifact";
         readonly format: "plist" | "javascript" | "source-map";
       });
+
+/** Whether an executable target contains a thin or universal Mach-O image. */
+export const isMachOFormat = (
+  format: unknown,
+): format is "mach-o" | "mach-o-universal" =>
+  format === "mach-o" || format === "mach-o-universal";