fix: keep the workspace green on macOS after the mic/touch/rich-input batch

The new features were Linux-built only and broke the documented macOS gate
(cargo build/test/clippy --workspace) four ways, all fixed following the existing
platform-gating conventions:

- m3.rs: mic_service_thread split into the Linux worker and a non-Linux stub that
  drains and drops (sessions still count the datagrams) — opus/PipeWire are
  Linux-gated deps, same pattern as audio_thread.
- punktfunk-client-rs: the new `opus` dependency moved into the Linux target table and
  --mic-test gated with a warn-and-skip stub (only the synthetic-tone test rig needs
  the encoder; the mic uplink itself is portable).
- gamestream/audio.rs: SAMPLE_RATE import gated to any(linux, test) (the frame_sizing
  test uses it everywhere, the data plane only on Linux).
- tests/c_abi.rs: the harness's macOS link flags gained Security + CoreFoundation —
  the quic feature now pulls rustls's platform verifier into the staticlib.

Also: two clippy match-ref-pats lints in the new rich-input/HID-output decoders
(clippy -D warnings is the repo gate), the regenerated punktfunk_core.h committed (the
checked-in copy predated the rich-input/HID-output constants — CI fails on drift), and
web's inlang cache dir gitignored.

cargo build/test/clippy/fmt --workspace: green on macOS, 122 tests passing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/punktfunk-host/src/gamestream/audio.rs

@@ -17,6 +17,7 @@
 //! data packets are consumed immediately and missing parity only costs loss recovery — so
 //! the validated stereo path stays byte-identical (data packets only, exactly as before).
 
+#[cfg(any(target_os = "linux", test))]
 use crate::audio::SAMPLE_RATE;
 #[cfg(target_os = "linux")]
 use {

crates/punktfunk-host/src/m3.rs

@@ -806,10 +806,22 @@ impl MicService {
     }
 }
 
+/// Stub — mic passthrough needs Linux (PipeWire source + libopus); non-Linux dev builds
+/// drain and drop the frames (sessions still count the datagrams), same as when the
+/// source fails to open.
+#[cfg(not(target_os = "linux"))]
+fn mic_service_thread(rx: std::sync::mpsc::Receiver<Vec<u8>>) {
+    tracing::warn!(
+        "punktfunk/1 mic passthrough requires Linux (PipeWire + libopus) — frames dropped"
+    );
+    for _ in rx {}
+}
+
 /// The host-lifetime mic worker: lazily open the virtual mic + decoder, then Opus-decode each
 /// forwarded frame and push the PCM into the source. Reopen (after [`INJECTOR_REOPEN_BACKOFF`])
 /// on open failure or a decode error. Exits when every session sender and the service's own
 /// sender drop (host shutdown), tearing the PipeWire source down.
+#[cfg(target_os = "linux")]
 fn mic_service_thread(rx: std::sync::mpsc::Receiver<Vec<u8>>) {
     let mut mic: Option<Box<dyn crate::audio::VirtualMic>> = None;
     let mut decoder: Option<opus::Decoder> = None;