ci: add macOS arm64 (Metal) build (#2)

* ci: add macOS arm64 (Metal) build for stable-diffusion.cpp

Adds a macos-arm64-cmake job covering [macos-14, macos-latest] that builds
leejet/stable-diffusion.cpp with Metal enabled and produces a release-ready
sd-*-bin-Darwin-macOS-<ver>-arm64.zip artifact, mirroring the existing Linux
job's naming convention. Wired into the release job so macOS arm64 binaries
are attached alongside Linux/Windows on scheduled and manual releases.

* ci(macos): bake @loader_path rpath so dylib loads next to binary

Without this, sd-cli ships with the GitHub runner's absolute build path
hardcoded in its rpath and fails at runtime with 'Library not loaded:
@rpath/libstable-diffusion.dylib'. Mirrors llama.cpp's release.yml flags.

* ci(macos): use stable artifact filename without OS version

Drop the dynamic Darwin-macOS-{sw_vers}-arm64 suffix in favor of a stable
sd-{branch}-{hash}-bin-Darwin-arm64.zip name (with -latest variant for
macos-latest). The previous naming embedded the runner image's macOS
point release (e.g. 14.8.5, 15.7.4), which churns silently as GitHub
patches the image and would break downstream consumers (Lemonade C++)
that download by exact filename. Matches the fixed-name pattern already
used by the Windows builds.

* ci: grant contents:write so the release job can publish artifacts

Without this, the workflow's GITHUB_TOKEN defaults to read-only on forks
and the 'Create release' / 'Upload release' steps fail with HTTP 403
'Resource not accessible by integration'. Same fix the Linux/Windows
release flow needs to function on Geramy's fork; safe on upstream where
the org-default token already has write access (this just makes it
explicit and forks-portable).

* ci(macos): name artifact …Darwin-arm64-metal.zip to align with backend ID

Lemonade's recipe matrix is adopting a 'metal' backend identifier for
macOS arm64 (mirroring the existing llamacpp/metal pattern). Renaming
the artifact's suffix to match keeps Lemonade C++'s download URL
construction trivial (filename = sd-{ver}-bin-Darwin-arm64-metal.zip)
and signals to consumers that this build has Metal acceleration enabled
(GGML_METAL=ON GGML_METAL_USE_BF16=ON GGML_METAL_EMBED_LIBRARY=ON).

Author: Geramy

.github/workflows/build.yml

@@ -13,6 +13,9 @@ on:
 env:
   BRANCH_NAME: master
 
+permissions:
+  contents: write
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
   cancel-in-progress: true
@@ -549,6 +552,70 @@ jobs:
           path: |
             sd-${{ env.BRANCH_NAME }}-${{ steps.commit.outputs.short }}-bin-${{ steps.system-info.outputs.OS_TYPE }}-Ubuntu-${{ env.UBUNTU_VERSION }}-${{ steps.system-info.outputs.CPU_ARCH }}-rocm-${{ matrix.ROCM_VERSION }}.zip
 
+  macos-arm64-cmake:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-14
+            label: macos-14
+            archive_suffix: ""
+          - os: macos-latest
+            label: macos-latest
+            archive_suffix: "-latest"
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - name: Clone
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+          fetch-depth: 0
+          repository: 'leejet/stable-diffusion.cpp'
+
+      - name: ccache
+        uses: ggml-org/ccache-action@v1.2.21
+        with:
+          key: macos-arm64-${{ matrix.label }}
+          evict-old-files: 1d
+
+      - name: Build
+        id: cmake_build
+        run: |
+          sysctl -a
+          mkdir build
+          cd build
+          cmake .. \
+            -DGGML_METAL=ON \
+            -DGGML_METAL_USE_BF16=ON \
+            -DGGML_METAL_EMBED_LIBRARY=ON \
+            -DSD_BUILD_SHARED_LIBS=ON \
+            -DCMAKE_INSTALL_RPATH='@loader_path' \
+            -DCMAKE_BUILD_WITH_INSTALL_RPATH=ON \
+            -DCMAKE_BUILD_TYPE=Release
+          cmake --build . --config Release -j $(sysctl -n hw.logicalcpu)
+
+      - name: Get commit hash
+        id: commit
+        if: ${{ github.event_name == 'schedule' || github.event.inputs.create_release == 'true' }}
+        uses: prompt/actions-commit-hash@v2
+
+      - name: Pack artifacts
+        id: pack_artifacts
+        if: ${{ github.event_name == 'schedule' || github.event.inputs.create_release == 'true' }}
+        run: |
+          cp ggml/LICENSE ./build/bin/ggml.txt
+          cp LICENSE ./build/bin/stable-diffusion.cpp.txt
+          zip -j sd-${{ env.BRANCH_NAME }}-${{ steps.commit.outputs.short }}-bin-Darwin-arm64-metal${{ matrix.archive_suffix }}.zip ./build/bin/*
+
+      - name: Upload artifacts
+        if: ${{ github.event_name == 'schedule' || github.event.inputs.create_release == 'true' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: sd-${{ env.BRANCH_NAME }}-${{ steps.commit.outputs.short }}-bin-Darwin-arm64-metal${{ matrix.archive_suffix }}.zip
+          path: |
+            sd-${{ env.BRANCH_NAME }}-${{ steps.commit.outputs.short }}-bin-Darwin-arm64-metal${{ matrix.archive_suffix }}.zip
+
   release:
     if: ${{ github.event_name == 'schedule' || github.event.inputs.create_release == 'true' }}
 
@@ -560,6 +627,7 @@ jobs:
       - windows-latest-cmake-hip
       - windows-latest-rocm
       - windows-latest-cmake
+      - macos-arm64-cmake
 
     steps:
       - name: Clone