t27b: the Mach-O object layout and bytes are a t27 spec (port slice of #6198) #7526

Port slice of #6198 (t27b written in t27), under #6063 and #5980.

cli/t27b/src/macho.rs (233 lines of hand-written Rust) writes the Mach-O 64-bit relocatable object that t27b build emits. Its pure part -- the layout (where the commands, __text, __const, relocations, symbols and strings start, and the alignment math) and the serialization of the header, the load commands, the relocation pairs and the nlist records -- moves into specs/tri/t27b/macho.t27, reaches cli/t27b through t27c gen-rust as gen/rust/tri/t27b/macho.rs, and is mounted like check_budget.

What stays hand-written in macho.rs is glue: the code words as bytes, the sorted exported names, the string table, and copying text, data and strings into the buffer at the offsets the spec computes.

The oracle is the current Rust: the spec's tests compare against bytes printed by master's macho::object for three images (no data; three blobs and two references; twelve blobs, four references, a function without an offset). Done means: byte-identical objects for the whole corpus between master and head, t27b lab counts unchanged with mismatch 0, cargo test -p t27b passing, and the AGENTS.md debt line shrinking.

Boundary

• specs/tri/t27b/macho.t27
• cli/t27b/src/macho.rs
• gen/rust/tri/t27b/macho.rs