feat: integrate macOS privileged proxy helper

[kev1n77]

Summary

• launch the macOS proxy helper through a static administrator-authorized AppleScript with every dynamic argument shell-quoted
• wire persistent helper sessions and authorized startup recovery into the Tauri desktop lifecycle
• add strict helper CLI parsing, private artifact validation, identity checks, and recovery permission tests
• update recovery, security, and progress documentation

Verification

• cargo fmt --all -- --check
• cargo fmt --manifest-path apps/desktop/src-tauri/Cargo.toml -- --check
• cargo test -p codeischeap-proxy-recovery --all-targets
• cargo check -p codeischeap-proxy-recovery --all-targets --target aarch64-apple-darwin
• cargo clippy -p codeischeap-proxy-recovery --all-targets --target aarch64-apple-darwin -- -D warnings

The full desktop/workspace matrix is delegated to CI because this Windows host does not have Perl for vendored OpenSSL or an Apple C toolchain.