ci(release): drop Intel macOS (darwin-amd64) build

The macos-13 (Intel) runner is a scarce, sunsetting GitHub tier — no
longer in the available-images list — so the darwin-amd64 leg queued
indefinitely and blocked the entire 26.06.3 release from publishing.
Apple no longer ships Intel Macs; Homebrew on macOS is Apple-Silicon-only.

Removes the macos-13 matrix leg and its darwin-amd64 references in the
SLSA hash-subjects list and the release files block. Release notes updated
to state the macOS build is Apple Silicon only.

chore(release): prep 26.06.2 — version refs, chart appVersions, relea…

…se notes

- RELEASE_NOTES_2026.06.2: status In progress -> Released 2026-06-26.
- helm/arc-enterprise + helm/arc: appVersion 26.06.1 -> 26.06.2 (chart default
  image now pulls 26.06.2; chart versions bumped). Enterprise chart README drops
  the now-obsolete "default is 26.06.1, set image.tag manually" IRSA caveat —
  IRSA query reads work on the default image as of 26.06.2.
- README: install download links (.deb/.rpm/.tgz) 26.06.1 -> 26.06.2. Historical
  "since v26.06.1" feature-provenance notes left intact.

Deploy compose/k8s examples already use :latest (unchanged).

docs(release-notes): flip 26.06.1 status to Released

Final pre-cut flip: the notes were marked "In progress" while PRs
were still landing. With #463–#470 all merged and the Docker Hub
publish path validated end-to-end, the release is ready. Cutting
release/26.06.1 next, which will trigger the release-build workflow.

docs(readme): bump install URLs to v26.05.1

Merge pull request #368 from Basekick-Labs/release/26.04.1

fix(security): restrict temp file permissions and validate memory_limit

Merge pull request #358 from Basekick-Labs/fix/compaction-batch-filen…

…ame-collision

fix(compaction): batch filename collision causes up to 84% data loss

fix(wal): use atomic operations for WAL writer metrics

WAL writer metrics (TotalEntries, TotalBytes, TotalSyncs, TotalRotations)
were incremented with plain ++ from the writer goroutine but read from
test goroutines and Stats(), causing data races under -race. Switch all
writes to atomic.AddInt64 and reads to atomic.LoadInt64.

Merge pull request #201 from Basekick-Labs/release/26.02.2

Release Arc 2026.02.2

Fix/wal columnar recovery (#174)

* fix(wal): native columnar recovery, database envelope, and shutdown purge

- WAL reader now handles both row and columnar entry formats natively,
  eliminating the row-conversion roundtrip during recovery
- Database name is stored in WAL entries via an envelope format
  (0x01 marker + db name), enabling correct routing on recovery
- AppendRawWithMeta builds WAL entries in a single allocation to avoid
  copying the ~104KB payload (fixes throughput regression)
- WAL files are purged on clean shutdown after buffer flush, preventing
  duplicate recovery on restart
- Fixed _database/_measurement key mismatch in row-based WAL recovery

* fix(wal): downgrade incomplete entry log from ERROR to WARN

Partial reads during periodic recovery are expected when the active WAL
file is being written concurrently. Not an error condition.

Update arc.toml