Harden Vifty safety, diagnostics, and UI evidence

[Reedtrullz]

Summary

• harden preference, policy, and agent-control persistence failure handling
• make diagnostics and viftyctl contracts report unavailable state truthfully and fail closed
• fix UI control races, accessibility metadata, review deadline handling, and host/worktree-independent verification
• refresh the exact-source automated UI checkpoint with 50/50 sealed rows

Safety Impact

• Fan/SMC writes: No new direct write path; existing daemon-first, allowlist, clamping, and restore boundaries remain intact.
• Privileged daemon, helper, installer, signing, or XPC identity: Improves helper-install status reporting and XPC status coding; release and identity boundaries remain fail closed.
• viftyctl, agent leases, JSON contracts, or workload wrappers: Adds help, persistence-health visibility, explicit null/status fields, and unavailable-state behavior with schema/example coverage.
• Hardware validation, release trust, compatibility, or unsupported-hardware policy: No new hardware or release compatibility claim; trust gates and schemas were verified.
• UI state for Auto restore, helper health, fan ownership, or active agent cooling: Fixes Auto/draft race handling and makes state/readiness presentation more truthful.
• Local persistence, permissions, telemetry, or audit history: Adds recoverable private preference backup behavior and surfaces policy/audit persistence failures; no persistent telemetry added.

Verification

make verify-full
# 2,030 Swift tests, 0 failures
# warnings-as-errors build, release-mode app bundle, plist, deep codesign,
# schema, identifier, release, governance, installer, helper, and UI contract gates passed

make ui-review-verify-automated
# 50/50 exact-source rows passed: 9 fixtures, 28 visuals, 13 AX predicates

Read-only bundled viftyctl diagnosis exited 75 in the documented blocked-daemon state. No helper repair, fan command, SMC write, install, tag, or release was performed.

Safety Checklist

• make verify passes locally, or each skipped gate is explained
• make verify-full passed locally or GitHub Actions runs the full slow suite for this PR
• New tests added for new functionality or bug fixes
• SMC write paths still reject arbitrary keys, invalid fan IDs, invalid RPM ranges, and mismatched fan commands before IOKit access
• Agent cooling remains lease-based, bounded, child-command-preflighted, and Auto-restoring; agents still use safeToRequestCooling, daemonControlPathReady, manualControlActive, and recommendedAgentAction
• Unprivileged app paths still fail closed when daemon/helper, hardware, sensor, fan, or thermal-pressure state is uncertain
• Release, signing, notarization, TeamID, cask, or schema-resource changes were checked with the release metadata/verifier scripts
• Hardware-validation or compatibility changes stay evidence-based and do not ask for manual fan-write smoke tests when readiness is blocked
• New local persistence keeps private permissions and does not add persistent telemetry beyond documented agent-control audit state
• Public docs, AGENTS.md, examples, JSON Schemas, and issue templates were updated when behavior or contracts changed

Related Issues

Comprehensive audit and remediation follow-up.