deps: re-sign bundled zstd on macOS (#61355)
Rewriting the bundled zstd executables with install_name_tool
invalidates their existing signatures on macOS. Re-sign them ad
hoc after updating the rpath so the CLI remains launchable for Pkg
archive decompression.
Add a regression test that runs the bundled zstd executable
instead of only checking that libzstd can be loaded.
Fixes #61354 (but see discussion there as to whether it really does?)
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Codex <codex@openai.com>
