Gate Time Machine helper release readiness

[dbuskariol]

Summary

• centralize the production helper readiness proof and require the canonical installed app
• add clean first-registration acceptance that uses public Service Management plus authenticated helper code-hash verification
• bind production publishing to exact candidate evidence and advance 0.4.0 to build 13

Verification

• swift test — 544 tests, 3 documented skips, 0 failures
• Scripts/verify-ci.sh — passed, including real restic and real rclone Time Machine lifecycle tests
• acceptance command disabled/noncanonical guards — passed
• missing runtime evidence fails closed — passed

Native approval boundary

Apple requires administrator approval before an SMAppService launch daemon is eligible to run. The exact installed helper-launch gate is therefore intentionally interactive on a clean acceptance host; headless CI cannot simulate or bypass it.