chore(build): remove bundled Z3 support

[SDAChess]

Summary

Remove the unused bundled-z3 feature and its remaining build, test, and documentation references. Builds now use toolchain-provided Z3 on Linux and macOS and the existing prebuilt Z3 path on Windows.

Related Issue

No issue required: mechanical build cleanup removing an unused feature and orphaned build infrastructure.

Changes

• Remove bundled-z3 feature forwarding from the prover, server, and gateway crates.
• Remove the Z3 source-build dependency chain from Cargo.lock.
• Update build and E2E paths to use toolchain-provided Z3.
• Remove obsolete bundled-Z3 CMake cache cleanup.
• Remove the unused osxcross macOS Dockerfiles and their Trivy exclusion.
• Update build, contributor, compute-driver, and Windows documentation.

Testing

• mise run pre-commit passes
  • Could not start because local mise bootstrapping attempted to build Python without a C compiler.
• Existing prover unit tests pass (27 passed)
• Unit tests added/updated
• E2E tests added/updated (not applicable)
• cargo check --locked --offline -p openshell-gateway
• Cargo lockfile checks
• ShellCheck
• Markdownlint
• Agent infrastructure consistency audit
• No bundled-z3, z3/bundled, or z3-src references remain

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3275.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for ba19bea. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[github-actions]

Label test:e2e-kubernetes applied for ba19bea. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute Kubernetes HA and credential-driver E2E after building the required gateway and supervisor images once. This is an optional proof-of-life suite; failures are visible in the workflow run but do not publish a required CI gate status.

[github-actions]

Label test:e2e-gpu applied for ba19bea. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute GPU E2E after building the required supervisor image once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[elezar]

Thanks @SDAChess. Looks OK from my side, but it may be good to get @pimlock or @drew to weigh in here too.

[elezar]

A note from tracing the Z3 history and terminology:

• bundled-z3 was introduced with the prover in #741 as an opt-in fallback for developers without a system Z3. It mapped to z3/bundled and compiled Z3 from source; Linux and macOS otherwise used the system library.
• The early Windows work made windows-msvc.ps1 explicitly enable that source-build path in 81cb5ac.
• #2738 then replaced the Windows source-fetch/build/cache machinery with the upstream precompiled-release path. The relevant branch commit was c2554cb, included on main through the squashed merge ddc8bba. That change added OpenShell prebuilt-z3 aliases mapping to z3/gh-release, pinned Z3_SYS_Z3_VERSION=4.16.0, and removed the bundled-specific PowerShell logic. This is why those .ps1 changes should not be reintroduced by this PR: they are already on main via ci(windows): add Windows MSVC CI jobs #2738.
• In the current z3-sys dependency, bundled is itself a deprecated alias for vendored. Both mean compiling the source shipped by z3-src; gh-release instead downloads a precompiled platform artifact. Therefore renaming the Windows prebuilt-z3 alias to vendored-z3 would either be semantically misleading if it continued to map to gh-release, or would change behavior back to the slower source build if mapped faithfully.

So the clean split is: system Z3 by default on non-Windows platforms, prebuilt-z3 / z3/gh-release in the Windows build tasks, and removal of the now-unused bundled-z3 source-build aliases as proposed here.