Deduplicate Login Items recovery action

[dbuskariol]

Summary

• give the shared Review Login Items recovery command one deterministic owner in the Permissions surface
• add four-state regression coverage and exact manual acceptance wording for the simultaneous-attention state
• advance Delta 0.4.0 to immutable build 14 and fail closed if project.yml drifts from the generated Xcode build metadata

Verification

• Scripts/verify-ci.sh
• /usr/bin/swift test (545 tests, 3 documented optional integration skips)
• real local restic lifecycle
• real local rclone Time Machine lifecycle
• manual acceptance matrix consistency

Release safety

No installed-app, Service Management, Full Disk Access, tmutil, or administrator-prompt acceptance is claimed by this PR. Those exact-candidate gates remain required before publication.