feat: add a secure native macOS control app and release hardening

[Eim-aa]

Summary

• add a native macOS menu/Dock control app with onboarding, diagnostics, login-item handling, and Keychain-backed Volcengine configuration
• protect loopback APIs with an owner-only bearer token, Host/Origin checks, fail-closed credential handling, and a crash-safe cloud-removal kill switch
• harden Hammerspoon request generations, popup behavior, long-text copying, warning redaction, and engine-state races
• make install, launchd upgrade, native-app replacement, and uninstall paths ownership-aware and transactional
• add Python, Swift, Lua, and shell CI coverage and align the privacy/install documentation with the actual product

Validation

• pytest: 110 passed
• Ruff and Python compileall: passed
• Lua syntax and Hammerspoon runtime behavior contracts: passed
• Swift arm64/x86_64 type-check: passed
• onboarding policy: 15 passed
• window-frame policy: 12 passed
• Universal macOS app build and strict ad-hoc codesign verification: passed
• final scope/secret audit: no real credentials, private keys, local machine paths, or P0/P1 release-code blockers found

Review notes

• This is ready for a controlled beta, not public distribution.
• Public release still needs Developer ID signing, notarization, a DMG/PKG, dependency/release checksums, and a clean-Mac install matrix.
• macos/AppIcon.png is a source build asset and contains OpenAI Media Service C2PA provenance.
• Local build outputs and the unrelated legacy scripts/start_service.command were intentionally excluded.