[chruffins]

Summary

Add hypeman build --machine-base-image for digest-pinned native macOS recipe builds. The CLI uses the existing SDK extra-field mechanism until generated clients expose the selector, and retains the existing build status and event stream.

--machine-network-mode egress explicitly permits unrestricted VZ NAT for pinned artifact downloads. Networking otherwise remains isolated; no domain allowlist is implied.

Existing and new flows

Existing Linux: archive source -> existing Dockerfile/builder parameters -> POST /builds -> stream events
New macOS: archive source -> validate pinned machine base and native networking -> reject Linux-only flags -> machine multipart fields -> POST /builds -> same event stream

CPU and memory fields are sent only when explicitly requested. Linux multipart fields and defaults remain unchanged.

Testing

• go test ./... — passed.
• Tests cover the exact macOS multipart field set, invalid digests, explicit egress, rejected Linux-only flags, and unchanged Linux fields.

Rollout

Requires a server exposing native machine builds. Does not publish a CLI or SDK release or enable builds on any host.