Harden status handling and macOS build pipeline

[Houtx]

What changed

• Fix Unix timestamp encoding for cached snapshots and probes.
• Validate status payload size, timestamps, service counts, duplicate models, uptime values, and summary consistency.
• Use the server generation time for stale-data detection.
• Keep the desktop widget on a visible screen after display changes and strengthen position locking.
• Compile the Liquid Glass path only with a compatible SDK while retaining the macOS 14/15 material fallback.
• Package the same .icns icon in command-line, Xcode, and Widget builds.
• Remove the duplicate legacy LaunchAgent path and rely on the app login-item registration.
• Clean large intermediate module caches after builds.
• Add no-Xcode core tests and a macOS CI build.
• Add retries and release-asset URL validation to appcast publishing.
• Replace the local appcast script's rg dependency with macOS-provided grep.

Why

The audit found a real cache timestamp epoch mismatch, unbounded/unvalidated API data, possible off-screen widget restoration, inconsistent icon packaging, duplicate login startup mechanisms, and hundreds of megabytes of disposable build cache. The project also had no PR build check for the Command Line Tools path.

Validation

• ./scripts/test.sh
• ./scripts/build.sh with -warnings-as-errors for arm64 and x86_64
• Universal 2 architecture checks for app, Widget, and Sparkle
• Deep codesign verification for the complete app bundle
• plist, project, workflow YAML, and shell syntax checks
• Live launch, status fetch, glass/material rendering, lock control, and manual refresh check
• Online signed v1.5.0 appcast verification