Bundle a pinned mo engine into Burrow releases

[caezium]

Summary

Burrow requires a separately brew install'd mo and drives whatever version
the user has. Bundle a pinned mo so the app works out of the box.

Why

• Onboarding — no mo, no app today (the engine_missing path).
• Reliability — Burrow's JSON parsing + interactive-TUI driving are coupled
  to mo's exact output; pinning kills "works on my mo version" breakage.
• Trust — elevation currently runs the user's Homebrew mo (on a default
  Apple-Silicon Homebrew, /opt/homebrew is user-writable) as root; a signed
  binary inside the app is read-only and safer to elevate.

Principles

• Prefer the user's mo if present (PATH/Homebrew); bundled is the fallback.
• Ship unmodified upstream mo with its LICENSE + prominent credit, and
  keep the "buy mole.fit ($9) to fund mo" note. No rebranding.

Tasks

• Choose bundle location and wire it into the build.
• MoleCLI.findExecutable(): prefer PATH/Homebrew, fall back to bundled.
• Pin a specific mo version; surface it in Settings.
• Code-sign the bundled binary — sequence behind notarization (don't ship
  a root-elevated unsigned binary).
• Include mo's LICENSE + attribution (About / Acknowledgements + release).
• Update the Homebrew cask: drop depends_on "mole".
• Rework Settings → Update Mole (bundled engine updates with the app;
  keep a manual path for users running their own mo).
• Check app-size + notarization impact.

Non-goals

• Replacing a user's own mo when present.

References

• SECURITY.md (privileged-execution + signing roadmap)
• tw93/Mole (MIT, © tw93)