fix: restore fresh Flutter Apple dependency scanning

[leehack]

Scope

Closes #490. Closes #492.

Repairs the merged PR #484 regression: its hook output registered a nonexistent Artifacts directory, causing Flutter 3.47.1 dependency scanning to fail before tests. Track the existing SwiftPM manifest parent instead; hooks_runner directory hashing observes child names, so adding/removing Artifacts invalidates cached success. Exact companion ABI validation and local-override rejection remain unchanged.

The new Unreleased note exposed the separate Web pin checker lifecycle defect #492. Pin-free Unreleased notes now use only the immediately following exact pubspec-version release section. Missing/mismatched sections and stale, malformed, or duplicate current pin claims fail closed. No historical notes were rewritten, and no native/Web/LiteRT pin changes.

Exact-head validation

Head: d7ac6a7. Base: 44ec6b2. Clean worktree, 0 behind / 5 ahead.

• Actual macOS Flutter 3.47.1 clone: fresh and warm test success, add empty Artifacts and fail the guard, remove it and succeed without clearing caches: PASS (16 seconds locally, also passed hosted macOS).
• Durable local-only integration is explicitly run with --run-skipped in the existing macOS native CI job.
• Hook suite: 34/34 PASS, including matching/mismatching ABI metadata and override rejection.
• Web pin checker: 57/57 PASS, including canonical root and website malformed/stale/duplicate claim fixtures.
• Full local VM: 2,052 PASS / 77 fixture-dependent skips.
• Canonical Flutter 3.47.1 workspace preparation, repository format (591 files, 0 changes), and full dart analyze: PASS.
• Release docs version check and offline Web pin/provenance gate: PASS.
• Hosted current-head checks: 14/14 SUCCESS, including Windows/macOS native, Linux VM+coverage aggregate, Chrome, Web Chat Contract real worker/GGUF smoke, docs, both companions, parity, LiteRT Linux/Windows and advisory.
• CI run: https://github.com/leehack/llamadart/actions/runs/34223963745
• Initial Windows attempt stopped in Flutter setup with curl exit 35 before dependency/test execution. One targeted same-head Windows-only rerun passed; no source change or publication dispatch was used to mask it.
• Fresh independent Astra audit: PASS on this exact head and base. Reviewed actual hook call sites, runner directory hashing, ABI/override guards, dedicated CI execution and checker fallback boundaries; independently reran checker 57/57. Zero blocking findings.
• GraphQL review threads: 0 total / 0 unresolved. No automated approving review is claimed.

High-risk review

Artifact-consumer and regression-policy scope. Zero known PR-caused P1 regressions. Independent exact-head adversarial review and all populated checks are complete. Repository-local readiness is established; external status-publisher governance is unchanged and no configured attestation is claimed. PR remains draft pending maintainer decision.

Preservation and boundaries

Original dirty iPad worktree and draft #489 untouched. No force push, mark-ready, merge, release, publication, workflow_dispatch, environment/settings, pin, or physical-device action. The only manual CI action was the targeted failed Windows job rerun described above.