release(app-store): ship a sandboxed Mac App Store build

[tcballard]

Objective

Add a second, sandboxed distribution channel so ordinary Mac users can install Sorting Hat through the Mac App Store while Developer ID and Homebrew remain available for direct distribution.

Scope

• Add an App Store build configuration and sandboxed main-app entitlements.
• Preserve user-selected read/write folder access through security-scoped bookmarks.
• Preserve the Finder Action and shared App Group queue with matching distribution profiles.
• Remove the legacy PCC command-line adapter from the shipping app dependency graph.
• Add archive, entitlement, nested-extension, and export preflight automation.
• Prepare App Store Connect metadata, privacy disclosures, screenshots, support URL, and review notes.
• Upload a signed archive with Apple Distribution and validate it through App Store Connect/TestFlight.
• Exercise first-run setup, Inbox monitoring, sorting, manual review, Finder Action intake, and launch at login in a sandboxed installed build.

Acceptance criteria

• The App Store configuration signs the main app and Finder Action with App Sandbox enabled.
• The main app has only the minimum required App Group, user-selected read/write, and outgoing-network entitlements.
• A sandboxed build persists access to chosen Inbox and output folders across relaunch.
• The Finder Action imports through the App Group without broad filesystem access.
• No shipping App Store target launches the fm CLI or another external executable for inference.
• The archive contains one installable app with the nested extension signed consistently.
• App Store export/upload preflight fails closed on missing profiles, identities, or entitlement mismatches.
• App Store Connect metadata, privacy answers, support URL, screenshots, and review instructions are complete.
• A TestFlight or App Store Connect build passes processing and the product contract is manually verified.

Excluded

• iOS/iPadOS client implementation.
• Native PCC support before the public SDK API is available and benchmarked.
• Replacing Developer ID/Homebrew distribution tracked in release(macos): ship a Developer ID signed and notarized build #24.
• Automatic updates for direct-download builds.

Owner prerequisites

• Mac App Store app record for com.tcballard.sortinghat.
• Apple Distribution certificate and matching Mac App Store provisioning profiles for the app and Finder Action.
• Registered App Group R8HXTBY3NM.com.tcballard.sortinghat attached to both identifiers.
• App Store Connect API credentials or an approved manual Xcode upload path.