Prepare trust-focused TestFlight runtime

[cbusillo]

Summary

Prepare Context Panel for a trust-focused TestFlight beta by making the installed runtime deterministic, restoring the native app/settings surface, and moving provider refresh onto safer local/OAuth-backed paths.

This PR intentionally keeps the work together because the runtime, provider, widget, Settings, signing, and storage changes were debugged and validated as one dogfood candidate.

What Changed

• Codified the canonical runtime workflow around /Applications/Context Panel.app.

  • Adds scripts/context-panel-runtime-baseline.sh with check, install, and reset modes.
  • Adds build fingerprint stamping/checking so ready-to-test claims can prove the running app/widget/refresh agent match this checkout.
  • Updates AGENTS.md with the runtime discipline that prevented stale DerivedData/worktree bundle confusion.

• Restored and polished the native app/settings experience.

  • Settings now owns provider setup/repair, background refresh, widget main-limit preferences, diagnostics, and a disabled/coming-soon Reset Primer section.
  • The main app now has a real overview/provider/detail flow rather than a debug/widget-preview dominated surface.
  • OpenAI account detail includes per-account windows, account identity, and plan text where available.
  • Widget and app copy has been softened for beta users.

• Reworked provider refresh and credential storage.

  • Adds Keychain-backed provider credential storage for imported auth/OAuth tokens.
  • Adds app-scoped secure file bookmarks for Code/OpenAI and Gemini auth files.
  • Adds Claude OAuth usage refresh and removes the old Claude WebKit capture path.
  • Keeps Gemini OAuth client metadata out of the repo; Gemini uses explicit environment metadata or discovers it from an installed Gemini CLI bundle.
  • Keeps Claude statusline/ccusage as fallback/diagnostic context, not the primary automatic refresh path.

• Re-enabled background refresh in a bounded, user-configurable way.

  • Adds persisted background refresh settings with interval clamping.
  • Registers/unregisters the refresh login item from Settings and app launch reconciliation.
  • Refresh agent reloads WidgetKit timelines after successful refreshes.

• Tightened snapshot, forecast, and stale-data behavior.

  • Preserves useful failed/stale provider data without overwriting fresh sibling account data.
  • Improves burn-rate/fast-mode forecast behavior for pooled accounts and sparse/ambiguous history.
  • Adds reset-primer planning/state plumbing but leaves actual primer execution deferred until provider-specific cheap, account-safe commands exist.

• Updates release/test docs and repo metadata.

  • Renames .github/github-repo-workflow.json to .github/github.json and removes old filename references.
  • Updates provider access docs, release docs, architecture notes, and TODO follow-ups.
  • Adds entitlement tests for app/refresh-agent/widget app group, keychain group, and sandbox/network expectations.

Important Notes

• Reset Primer is intentionally deferred. The UI now says it is coming soon, and the refresh agent does not run primer traffic.
• Gemini no longer ships a bundled OAuth client secret. It requires installed Gemini CLI metadata discovery or explicit GEMINI_OAUTH_CLIENT_ID / GEMINI_OAUTH_CLIENT_SECRET configuration.
• Claude Web capture was removed. Do not reintroduce WebKit usage scraping as a background refresh path.

Validation

• swift test passed 156 tests.
• git diff --check clean.
• scripts/context-panel-runtime-baseline.sh install --launch passed with baseline=OK.
  • App process: /Applications/Context Panel.app
  • Widget registration: /Applications/Context Panel.app/Contents/PlugIns/ContextPanelWidgetExtension.appex
  • URL handler: /Applications/Context Panel.app
  • Refresh login item: running from /Applications/Context Panel.app/Contents/Library/LoginItems/ContextPanelRefreshAgent.app

Follow-up Issues

• Keeps Validate TestFlight packaging and App Store icon separately #71 open for TestFlight packaging/export/upload validation.
• Keeps Clarify provider setup and permission repair for TestFlight #77 open for final provider setup/repair bad-path QA.
• Keeps Finish safe reset priming for supported providers #75 open/deferred for safe reset priming.
• Tighten status language and diagnostics for TestFlight #80 can close after this PR merges and the final wording is accepted.
• Triage dirty release-prep work into focused branches #66/Recover Context Panel release readiness after mixed-runtime regressions #64 can close after this PR becomes the canonical tracked TestFlight readiness branch.

Fixes #23
Fixes #25
Fixes #67
Supersedes #18