fix(macos): trust auto-capped voice CPU budgets

[tang-vu]

Why this matters

On an 8-core M1, install-macos.sh --all aborts before setup because voice selection raises the Docker CPU floor from 6 to 10. That gate is obsolete: the shipped macOS env generator now caps TTS, Whisper, Hermes, and ComfyUI CPU limits to the daemon's actual CPU count. The installer therefore rejects a Compose plan it can generate and run safely (reported in #3600).

Root cause: the installer retained two feature-specific preflight checks from before bundled service CPU limits became daemon-capped in #1362.

Invariant: optional feature selection must not raise the baseline Docker CPU requirement when every optional service limit is capped to the detected daemon capacity. An explicit ODS_MIN_DOCKER_CPUS operator policy remains authoritative.

What changed

• keep the existing six-CPU baseline and operator override
• remove both the CLI-time and post-prompt voice-specific 10-CPU gates
• document the env-generator contract next to the preflight

Overlap check

Searched open and closed PRs for macOS voice CPU budget, voice-enabled compose stack, issue #3600, and changes to ods/installers/macos/install-macos.sh. #1362 is the merged producer-side CPU-cap change; it does not remove the now-stale consumer gate. No open PR covers this installer rejection.

Regression boundary

tests/test-macos-installer-transitions.sh now asserts the public installer flow has exactly one baseline CPU gate, retains the six-CPU/operator-override contract, and cannot reintroduce a voice-specific floor. The existing generated-env smoke test separately proves TTS and all bundled service limits stay within the Docker CPU count.

Validation

• bash tests/test-macos-installer-transitions.sh — pass
• bash -n installers/macos/install-macos.sh tests/test-macos-installer-transitions.sh — pass
• git diff --check — pass
• bash tests/smoke/installer-env-smoke.sh — CPU-cap assertions pass; suite later hits the existing unrelated ai_err undefined-function audit failure in installers/phases/07-devtools.sh

Tradeoffs and rollback

This deliberately keeps the base six-CPU guard, so undersized daemon allocations still fail early. Operators who need a stricter policy can continue setting ODS_MIN_DOCKER_CPUS. Rollback is limited to restoring the two voice gates; no persisted state or Compose schema changes.

Closes #3600