feat(cli): add managed Nightly installation and lockstep updates

[xcv58]

Implements #403. Apple silicon Nightly users can install the matching optional CLI from Settings → General → Command Line with one confirmation. Managed installations then update automatically with MacTools; Command-Line Integration remains a separate permission switch. Stable and manually installed CLIs retain their existing workflows.

Behavior

• Command Line sits at the bottom of General settings. The compact status and primary action stay visible; Details and Terminal setup use full-width clickable headers. Manage contains removal and retained-version rollback.
• Installation requires consent, shows the version, download size, and paths, and offers to enable integration. Required macOS background-item approval is explained separately.
• Launch updates require an active owned receipt, including installations with the legacy update preference disabled. Users who never installed the managed CLI, or removed it, do not receive an automatic installation.
• An explicit rollback survives restarts of the same app release. The next app release or an explicit Update resumes the matching CLI. Failures retain the prior installation and offer retry and diagnostics without replaying actions.

Verification and publication

The installer trusts cli-install.json sealed inside the Developer ID signed app. It verifies bounded HTTPS downloads, archive structure, exact hash/size, arm64 architecture, publisher identity, notarization, embedded version/build, and protocol compatibility before activation. Quarantine remains intact.

Receipts bind the publisher, executable hash, and managed paths. Initial command creation refuses collisions, including dangling symlinks. Updates preserve the public command link and atomically switch a private version pointer. Post-activation version/doctor checks, a durable recovery journal, and retained versions support failure recovery. Removal and pruning validate ownership; shell configuration and unmanaged commands are not modified.

GitHub Nightly publication packages the signed CLI once, embeds its metadata before signing the app, and publishes that same archive and JSON after the existing notarization and verification gates. Release interface v4 rejects older source refs that cannot produce this contract. Personal publishers use the same immutable-release contract described in managed CLI distribution. The CLI remains a separate download.

Validation

Reviewed implementation: 3c55690f (the subsequent change only corrects distribution documentation).

• Full local make ci: 4,426 XCTest cases and 254 script tests passed, including PluginKit v6 binary compatibility.

• Fresh review run: 63 focused installer, recovery, localization, and native disclosure tests passed; 72 release-script tests passed.

• actionlint .github/workflows/nightly.yml and git diff --check passed.

• Implementation CI passed build/tests, script tests, changelog validation, PluginKit compatibility, and the unsigned Nightly build.

• Final-head CI passed on documentation commit bde41c83, including the full build/test, PluginKit compatibility, and unsigned Nightly checks.

Signed release acceptance still required

Ready for code review. Automated results and reported local Nightly testing do not establish the complete signed acceptance matrix. Record evidence for the final release candidate using the signed test checklist:

• macOS 26: Settings installation, background-item approval, integration disabled/enabled, quarantined version/doctor execution, N-to-N+1 update, offline recovery, downgrade, rollback across restarts/next release, collisions, and removal.
• macOS 27: the same signed acceptance matrix, including migration from the legacy update preference.

Keep these release checks visible after leaving draft. This PR is not an assertion that the final candidate has completed both operating-system acceptance runs.