Grant the CallHistoryDB folder so phone_calls_fetch can read the write-ahead log

[mattt]

phone_calls_fetch failed with SQLite error: authorization denied on every call. CallHistory.storedata is a WAL-mode database, so SQLite also opens the -wal and -shm files next to it on the first read. The security-scoped bookmark covered the store file alone, and the sandbox refused those companions with EPERM, which Apple's SQLite reports as "authorization denied". Reproduced with sandbox-exec denying only the two companion files; the same read with immutable=1 succeeds, which is why the Messages service never hit this.

Following #198, the Phone service now asks for the CallHistoryDB folder instead of the file, keeps the security scope open for the whole fetch, and asks again when it finds a file-only grant from an earlier version. If SQLite cannot open the log's companions, for example when they are absent and the folder is read-only, the read falls back to immutable=1; without a log, the main file already holds every record.