Add macOS CI matrix for macos-14, macos-15, and macos-26

Test Metal kernel builds across multiple macOS versions to verify
compatibility with the metal3.1 standard (macOS 14+). Use sandbox=relaxed
for Nix to support __noChroot builds that access the host Metal toolchain.
The separate Metal toolchain download is only needed on macOS 26+.

Co-developed-by: Claude Code v2.1.50 (claude-opus-4-6)

Author: robtaylor

.github/workflows/build_kernel_macos.yaml

@@ -9,21 +9,35 @@ on:
 
 jobs:
   build:
-    name: Build kernel
-    runs-on: macos-26
+    name: Build kernel (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-14
+            xcode: "/Applications/Xcode_15.4.app"
+          - os: macos-15
+            xcode: "/Applications/Xcode_16.2.app"
+          - os: macos-26-xlarge
+            xcode: "/Applications/Xcode_26.0.app"
     steps:
       - name: "Select Xcode"
-        run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
+        run: sudo xcrun xcode-select -s ${{ matrix.xcode }}
       - name: "Install Metal Toolchain"
+        if: matrix.os == 'macos-26-xlarge'
         run: xcodebuild -downloadComponent metalToolchain
       - uses: actions/checkout@v6
       - uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            sandbox = relaxed
       - uses: cachix/cachix-action@v16
         with:
           name: huggingface
           #authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
       # For now we only test that there are no regressions in building macOS
-      # kernels. Also run tests once we have a macOS runner.
+      # kernels. Also run tests once we have a macOS runner with GPU access.
       - name: Build relu kernel
         run: ( cd builder/examples/relu && nix build .\#redistributable.torch29-metal-aarch64-darwin -L )