Mac App Store variant (sandboxed, AppleScript reads)

[janthoXO]

Future work, DESIGN.md sections 7.4, 9.1, 11 (S6) and 13.

A sandboxed build for the Mac App Store, from the same code.

Scope

• Sandbox entitlements. The config moves into the sandbox container with no code change.
• An AppleScript scripting dictionary (R2) for reads, because CLI mode (R1) can't read the sandboxed config.
• The Raycast extension picks R1 or R2 based on the app variant it finds.

Blockers

• Needs the paid Apple Developer Program membership.
• Spike S6: can a sandboxed app set the default audio device? If not, there is no App Store variant.