feat: first-run permission setup wizard (0.6.3)

[chaodu-agent]

Summary

First install still requires the human to grant macOS TCC permissions — that cannot and should not be bypassed. 0.6.3 makes the one-time process explicit and usable instead of leaving it in README text.

• First launch with anything missing: auto-show once. Not Now is respected across launches and versions; fully-granted upgrades mark setup complete without a window.
• Three capability cards: Screen & System Audio Recording (Screens/screenshot), Accessibility (mouse/key), Full Disk Access (protected Mail/Messages/Safari via exec/osascript). Each opens the exact System Settings pane.
• Test Again; automatic one-shot refresh when returning from Settings. No timer, no screenshot, no prompting APIs — avoids the permission-popup storm recorded in oablab/oab-pty-mac#62.
• Explicit browser-only copy: browser_* works without any of these grants.
• Menu bar: permanent Set Up Permissions… plus live ✓/✗/? for all three.

Measurement

PermissionProbe is in Core and testable. Screen/AX use Apple's non-prompting preflight APIs. macOS has no FDA preflight API, so FDA is measured by actual open(O_RDONLY|O_CLOEXEC) + immediate close of an existing protected DB (user TCC.db, Safari History, Messages chat) — no bytes are read. Result is tri-state: granted / denied / unknown (no candidate exists). sys_info now exposes full_disk_access + state.

Verification

• macmini: 97 tests, 0 failures; packaging smoke OK.
• 9 new tests: FDA success stops at first open, all-denied, no-file unknown, exact protected paths, snapshot summary; first-run missing, Not Now, fully granted, unknown FDA policy.
• Real GUI smoke via a separate test bundle/port on the logged-in desktop. It caught two bugs unit tests cannot (constraint activated before shared hierarchy; NSBox cards collapsed to zero height); both fixed. Final screenshot shows aligned 3-row mixed-state window.
• Independent audit: no blocker; confirmed non-prompting APIs only, no polling, privacy-safe FDA probe, one callback per dismiss path, correct actor/lifecycle behavior.

Version

0.6.3. After merge, tag release uses the signed/notarized universal pkg pipeline proven by v0.6.2.