Fix session and storage reliability

[heznpc]

What changed

• harden AI session loading, cancellation, publication, backup, and restore state
• attribute Simulator device data, runtimes, and shared caches without double counting
• explain storage growth using comparable snapshots and keep cleanup behind Modore approval
• route storage warnings through the Modore app identity instead of Script Editor
• detect recent user-owned /private/tmp workspaces and the macOS per-user temporary root
• surface exact temporary workspaces as recoverable items, prioritizing recent growth without flooding the UI with unmeasured rows
• revalidate the exact path, owner, symlink boundary, open files, identity, and size before approved cleanup
• prioritize recoverable temporary and project artifacts before broad cache measurement
• remeasure storage whenever the explicit recovery route is opened, even when an older report exists
• make the bounded-tool guardian watch the real Bash 3.2 helper PID so SIGKILL cannot strand provider processes
• tighten iPhone storage and photo-library scan behavior and its test coverage

Why

The app could show stale work state, miss generic build/test temporary roots, under-report Simulator storage, and emit storage alerts under the wrong application identity. In particular, modore://storage/recovery treated any previously loaded report as current and skipped the scan, while temporary workspaces could consume tens of gigabytes yet remain visible only as an unactionable aggregate. These changes make recovery collect current evidence and turn an exact, idle workspace into an owner-approved recovery item without granting deletion semantics to an entire temporary root.

Verification

• PYTHONDONTWRITEBYTECODE=1 python3 -I -B -m pytest tests/test_macos_storage_protection.py tests/test_macos_cleanup.py tests/test_report.py -q — 174 passed
• swift test --package-path macos/Modore — 485 passed
• PYTHONDONTWRITEBYTECODE=1 python3 -I -B -m pytest tests/test_fileaccess.py tests/test_scree.py tests/test_macos_storage_protection.py -q — 544 passed
• bash -n scripts/cleanup.sh scripts/modules/macos/storage.sh and git diff --check passed
• production scanner detected a controlled 17 MiB workspace under DARWIN_USER_TEMP_DIR as transient_workspace
• production cleanup preview remeasured 17,408 KiB and execution removed only that approved controlled workspace; sibling/boundary/open-file behavior is covered by tests
• production SwiftUI app build succeeded for arm64
• installed app launched successfully; its recovery route completed a fresh bounded scan and the bundled storage module is byte-identical to commit 0bcc647
• the helper-SIGKILL regression passed 20 consecutive local runs; the complete storage protection file passed 46 tests
• refreshed the hourly LaunchAgent; enabled=true, loaded=true, loadedDefinitionCurrent=true