feat: launch bundled runtime from Flutter macOS

[wolfiesch]

Summary

• make the Flutter macOS app install, start, and connect to its bundled T4 host and pinned OMP runtime automatically
• connect over the private local Unix socket so normal local use does not require Tailnet setup
• sign the embedded OMP runtime with the native-addon entitlement and refresh the LaunchAgent when the app bundle changes
• support large bounded OMP session inventories so existing local history loads instead of falling back to sample or unavailable data
• extend macOS, Flutter, packaging, CI, and release-consistency coverage

Verification

• pnpm check
• pnpm test
• pnpm test:packaging
• Flutter analyze and 172 Flutter tests
• live Flutter Unix-socket test against the installed host
• 12 native macOS lifecycle tests
• clean debug app build with embedded runtime signature verification
• installed-app visual check: Ready state with existing local session history

Merge note

This changes the embedded runtime signing boundary, so it is ready for review but should receive explicit maintainer review before merge.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[riverpilot]

Merge blocker: the bundled local endpoint is passed as developmentEndpoint. _connectCurrent treats every non-null development endpoint as an unconditional override and never loads/selects a saved paired host, so macOS users can persist a remote host but can never connect to it afterward. Keep bundled-local discovery distinct from the development override and preserve explicit host selection/authentication. Add a regression covering local bootstrap followed by remote host selection, then rebase current main (#127 overlap) and rerun Flutter Apple + verify.

[riverpilot]

Implemented the requested endpoint-precedence repair, added regression coverage, rebased the complete contribution onto current main, and opened #130 as the mergeable replacement. Please close this superseded branch.

[iarbpairs]

Closing as superseded by #130, which preserves paired-host precedence and rebases the complete contribution onto current main. The replacement will remain gated on the Gate 1 endpoint-profile contract before merge.