ops(albok): vh joins every albok read group; macOS withdrawal-test run staged

Prime, 2026-10-09: "vh gets albok-everything". playbooks/nh3-albok-vh-viewer.yaml
joins vh to albok-read, albok-personal and albok-feedback on nh3-albok and
authorizes his four Macs' public keys for vh; verified at a fresh login that
every wing's .browse/ lists and reads.

The withdrawal harness gains a macOS driver (run-mac.sh: every mountable FUSE
backend, a read-only smoke of the real wings, results copied back), env
overrides for a non-container client, and summarize.py. Sanity-checked as vh
from the Linux container before staging.

scripts/oneoff/albok-browse-withdrawal/README.md

@@ -50,6 +50,16 @@ the server in the clean state (`.browse/` present, no `.browse.withheld`).
 - **Failed rename:** the path remains and is served. The service cannot deny opens it could not
   withdraw; its `BROWSE_WITHHELD` marker only stops publication.
 
+## macOS run (staged 2026-10-09 2245, not yet run)
+
+`run-mac.sh` runs the same trials from the operator's Mac, as `vh`, against a vh-owned replica at
+`~vh/albok-browse-test/wing` (`manifest-mac.json`). It tries every FUSE backend the Mac can mount with
+(the default, plus `backend=smb` / `backend=fskit` where fuse-t or macFUSE offers them), smoke-tests every
+real wing's view as vh (counts only), and copies its results to `~vh/albok-browse-test/results/`. The vh
+path was sanity-checked first from the Linux container (N=1 per condition, all four as expected).
+
+    mkdir -p ~/albok-browse-test && cd ~/albok-browse-test && scp 'vh@10.100.50.44:albok-browse-test/harness/*' . && zsh run-mac.sh
+
 ## Limits
 
 - **Proven for the Linux kernel FUSE client only.** A macOS workstation runs a different FUSE