Address review feedback on Intel-Mac broker gate

- Document that enable_broker_on_mac requires Apple Silicon (arm64) and
  that Intel Macs fall back to non-broker.
- Smoke test: opt in only via enable_broker_on_mac, so the script no
  longer reports a false failure on Windows/Linux hosts where the
  broker prerequisites are met.
- Keep the decorator stack contiguous by moving the explanatory comment
  onto the decorator line it describes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: ashok672

msal/application.py

@@ -2187,7 +2187,7 @@ def __init__(
                +--------------------------+-----------------------------------+------------------------------------------------------------------------------------+
                | enable_broker_on_wsl     | WSL                               | ms-appx-web://Microsoft.AAD.BrokerPlugin/your_client_id                            |
                +--------------------------+-----------------------------------+------------------------------------------------------------------------------------+
-               | enable_broker_on_mac     | Mac with Company Portal installed | msauth.com.msauth.unsignedapp://auth                                               |
+               | enable_broker_on_mac     | Apple Silicon Mac, Company Portal | msauth.com.msauth.unsignedapp://auth                                               |
                +--------------------------+-----------------------------------+------------------------------------------------------------------------------------+
                | enable_broker_on_linux   | Linux with Intune installed       | ``https://login.microsoftonline.com/common/oauth2/nativeclient`` (MUST be enabled) |
                +--------------------------+-----------------------------------+------------------------------------------------------------------------------------+
@@ -2227,7 +2227,10 @@ def __init__(
             New in MSAL Python 1.25.0.
 
         :param boolean enable_broker_on_mac:
-            This setting is only effective if your app is running on Mac.
+            This setting is only effective if your app is running on
+            an Apple Silicon (arm64) Mac.
+            Broker is not supported on Intel-based Macs, where this setting
+            is ignored and MSAL will fall back to non-broker.
             This parameter defaults to None, which means MSAL will not utilize a broker.
 
             New in MSAL Python 1.31.0.

tests/intel_mac_broker_smoke_test.py

@@ -52,9 +52,7 @@ def main():
     app = msal.PublicClientApplication(
         _CLIENT_ID,
         authority=_AUTHORITY,
-        enable_broker_on_mac=True,
-        enable_broker_on_windows=True,
-        enable_broker_on_linux=True,
+        enable_broker_on_mac=True,  # Only opt in on Mac; this script validates the Mac gate.
         )
     actual = bool(app._enable_broker)
     print(f"Actual   _enable_broker = {actual}")

tests/test_application.py

@@ -1621,8 +1621,7 @@ def test_client_id_should_be_a_valid_scope(self):
 
 
 @patch("sys.platform", new="darwin")  # Pretend running on Mac.
-@patch("msal.application.platform.machine", new=Mock(return_value="arm64"))
-# Pretend Apple Silicon, because broker is not supported on Intel-based Macs.
+@patch("msal.application.platform.machine", new=Mock(return_value="arm64"))  # Pretend Apple Silicon, because broker is not supported on Intel-based Macs.
 @patch("msal.authority.tenant_discovery", new=Mock(return_value={
     "authorization_endpoint": "https://contoso.com/placeholder",
     "token_endpoint": "https://contoso.com/placeholder",
@@ -1665,8 +1664,7 @@ def test_should_fallback_when_pymsalruntime_failed_to_initialize_broker(self):
 
 
 @patch("sys.platform", new="darwin")  # Pretend running on Mac.
-@patch("msal.application.platform.machine", new=Mock(return_value="arm64"))
-# Pretend Apple Silicon, because broker is not supported on Intel-based Macs.
+@patch("msal.application.platform.machine", new=Mock(return_value="arm64"))  # Pretend Apple Silicon, because broker is not supported on Intel-based Macs.
 @patch("msal.authority.tenant_discovery", new=Mock(return_value={
     "authorization_endpoint": "https://contoso.com/placeholder",
     "token_endpoint": "https://contoso.com/placeholder",