feat(macOS): add IDEA workflows, Spring support, and rendering safeguards

[1lck]

Summary

• add an IDEA-style Git workflow on macOS: searchable graph entries (including me), branch/reference comparison against the current working tree, untracked-file diffs, and branch actions such as fetch, checkout, compare, and cherry-pick
• add editor navigation history and command-catalog integration for back/forward, definition/implementation navigation, and guarded double-Shift search
• add Spring workspace intelligence for application.yml / application.yaml / properties completion, hover, diagnostics, configuration-class navigation, bean injection navigation, and endpoint discovery
• group all manifest-declared language plugins under a default-collapsed “More Language Support” section while retaining per-language enable/disable controls and search visibility
• prevent automatic GitHub credential restoration from presenting macOS Keychain authentication UI when a development or preview build has a different signing identity
• prevent AppKit-backed workbench content from being flattened into unsafe render layers; add regression coverage for the yellow-noise/empty-workspace failure mode
• stamp macOS app provenance and add build/package safety checks so stale or incorrectly assembled app bundles are rejected

Integration notes

• merged the latest preview/0.3.0 before opening this PR
• retained the target branch's configurable keymap architecture and registered the new navigation/Spring commands in that catalog
• kept AppModel.swift below the repository service-boundary limit by moving Git UI wrappers into AppModel+GitOperations.swift
• derive the language-plugin group from manifest capabilities instead of hardcoding language names
• keep explicit Keychain write/delete flows unchanged; only unattended credential restoration is non-interactive

Verification

• ./scripts/test-macos.sh — 446 tests across 51 suites passed
• ./scripts/verify-rust-core.sh — Rust tests, Swift bridge build, and linked-symbol verification passed
• ./scripts/verify-core.sh
• ./scripts/verify-git-graph.sh
• ./scripts/verify-windows-boundaries.sh
• ./scripts/verify-macos-app-build-safety.sh
• ./scripts/verify-service-boundaries.sh
• ./scripts/verify-shared-contracts.sh
• ./scripts/verify-rust-core-comments.sh
• cargo fmt --check
• git diff --check
• manually launched the freshly built preview bundle by its exact path, opened the small Spring/Git fixture, and confirmed no Keychain password prompt appeared
• manually verified the language group is collapsed by default, expands to 45 independently selectable plugins, resets hidden selection on collapse, and auto-expands for language searches