fix: release readiness — sessions survive outages, Keychain-only tokens, real script timeouts

[CLCK0622]

Why

A pre-release audit found issues that should be fixed before a stable v0.2.4:

• A brief network or server failure at launch signed the user out and revoked the session on the server.
• Launching offline showed a splash screen that spun forever.
• Release builds silently wrote tokens to a plaintext file whenever the Keychain refused a write, which contradicts the privacy policy.
• The weather location prompt probably failed under the hardened runtime, because the location entitlement was missing.
• AppleScript timeouts never took effect.
• Attachments were read on the main thread with no size limit.
• release.yml could build main HEAD under a tag's name, ran no tests, and would accept a stable tag from any branch.

What

fix:

• Session restore:
  • Only a refusal from the server signs the user out. Offline, a timeout, a 5xx or a captive portal keeps the session and shows a "can't reach inklet" screen with Try Again.
  • Requests fail fast instead of waiting for connectivity.
• Tokens: release builds keep tokens only in the Keychain. If a Keychain write fails, the session lives in memory for that launch. A plaintext file left by an older release is migrated into the Keychain and deleted.
• Location: added com.apple.security.personal-information.location. Weather is now off by default and asks for location only when turned on.
• AppleScript:
  • Context capture runs in an osascript child process, so the deadline kills it and it never blocks the main thread. NSAppleScript is main-thread-only and cannot be cancelled.
  • Photos exports are collected in one temp folder that gets cleaned up.
• Attachments: loaded off the main thread, limited to 10 MiB each and 50 per send, using the backend's list of accepted types.
• Termination: NSSupportsAutomaticTermination and NSSupportsSuddenTermination are set to false, so the menu bar app keeps its hot key and Services when no window is open.
• API host: one constant, overridable at build time with INKLET_API_BASE_URL for both the app and the widget. The default is still https://dev.iminklet.com.
• Session edge cases:
  • A 401 on History or Quote/0 signs out like everywhere else.
  • Services still works while signed out.
  • The OAuth callback must be exactly inklet://auth/callback.
  • Settings shows the Accessibility status for capturing highlighted text.

build(release):

• A resolve-tag job refuses a stable tag that isn't on main. Pre-release tags can still come from branches.
• The build checks out exactly the commit that job verified.
• A manual run takes only a tag; the stale version defaults are gone.
• swift test runs before the signing certificate is imported.

docs: removed the server IP, daemon user, login steps, internal tracker URL and absolute local paths from this public repo. They remain in git history.

Verification

• swift build is clean. swift test passes 71 tests (49 before). New tests cover session restore, OAuth callback parsing, attachment limits and the API host.
• ./Scripts/build-app.sh debug builds a bundle that passes codesign --verify --deep --strict, and its entitlements include the location entitlement.
• ScriptProcess was exercised on its own:
  • A normal result returns in 0.06 s.
  • A 10 s script is killed at a 1 s deadline.
  • A script stopped before launch never starts.
  • 200 KB of output doesn't stall the pipe.

Still needs a Developer ID-signed build

• The location prompt under the hardened runtime.
• Automation consent for the osascript child: it should be attributed to inklet Portal, and a Photos export should leave the UI responsive.
• Keychain-only token storage and migration of the legacy token file.
• Services from a cold launch, including while signed out.
• The release workflow itself, which runs on the next tag.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.