feat: implement file provider stability loop

[OpenCow42]

This PR makes File Provider stability and conflict behavior reproducible through deterministic tests and an opt-in native Finder runner. It also fixes failures demonstrated by those checks, including delayed working-set delivery, SQLite contention, incorrect Trash callback metadata, and hosted Actions controls.

The latest local validation passes all 12 live conflict checks. Fresh and already-running selected Finder suites each recorded 14 passes, one comments-setting failure, and permanent deletion unselected. The operator accepted the comments limitation as non-blocking on September 13 because file comments are outside the critical path. The app reports the unapplied setting explicitly; the test remains failed and CR-027 remains open for follow-up.

Changes

• Add the 16-scenario Finder suite and six independently selectable conflict races. Verify stable identities, parentage, versions, competing writes, exact remote/local bytes, cancellation, and correlated provider callbacks under fresh and already-running extension profiles.
• Expand deterministic coverage with isolated persistent clients, production callback executors, combined mutation fields, controlled races, lost responses, restart recovery, and seeded encrypted-journal replay. Preserve encrypted edits before Trash and reject incomplete callback inputs without acknowledging unsupported fields.
• Publish confirmed mutations to the working-set journal promptly. Coordinate bounded concurrent folder reads, guard snapshot/anchor commits, and cancel background work when the provider instance is invalidated. Reserve SQLite writers before read-before-write transactions and install the busy timeout before WAL initialization.
• Resolve provider-managed Trash authoritatively and return managed trashed metadata, including preserved conflict-copy identity/version. Correct activity expansion, directory timestamp handling, favorite metadata, explicit duplicate naming, upload-size validation, and retryable error mapping.
• Correct share-link access and expiration requests, omit unchanged fields while preserving explicit comment intent, and compare returned settings before claiming success. Preserve explicit password changes and reject unknown access policies. Acknowledged updates that return different settings display the server state and a warning.
• Repair extension provisioning/framework packaging, canonicalize opaque Finder action identifiers, and bind hosted panels to the attested build, owned Finder host, and exact item. Keep loading and diagnostic lookup off the UI actor. Expose version Restore controls through a native Form.
• Harden native menu/pointer targeting, real Copy Stop cancellation and subsequent recovery, exact confirmation matching, and action-result verification when AXPress reports an error after a completed operation. Settle prior diagnostic callbacks before the next working-set scenario without changing evidence correlation or scenario deadlines.
• Retain immutable reports and failed fixtures. Reject incomplete, stale, unrelated, or mismatched process/build evidence. Keep permanent deletion opt-in, scoped to the generated item, and excluded from default runs.

Validation and OS scope

The following local evidence covers implementation commit 887bdf2; subsequent commits document the accepted limitation and OS scope. Xcode was 26.5 (17F42).

Validation	Runtime	Result
Full macOS Stability unit target	macOS 26.6.2 (25G83), arm64	558 passed
Focused shared API/settings/callback tests	iPhone 17, iOS Simulator 26.5 (23F73)	24 passed
Focused shared API/settings/callback tests	Apple Vision Pro, visionOS Simulator 26.5 (23O470)	24 passed
Six native conflict cases in each extension profile	macOS 26.6.2 (25G83), arm64	All 12 passed and sealed
Selected native Finder/Actions suite, fresh and already-running profiles	macOS 26.6.2 (25G83), arm64	Each: 14 passed, comments failed, deletion unselected

Final iOS Simulator and generic visionOS builds passed. No XCTest UI suite was rerun during this local continuation; installed Finder/Actions behavior was exercised through native UI with independent server and byte checks. CI for the published head is separate from this local evidence; consult the current PR checks rather than earlier green runs.

Retained XCResult device records confirm the unit/simulator runtime versions. Live reports do not embed OS metadata; their attribution above is the shared host context. Future integration evidence must retain actual OS version/build, architecture, and Xcode version with run IDs. These results do not establish compatibility with the next macOS release. Rerun fresh and already-running Finder/Actions and conflict profiles after an upgrade, including panel/menu binding, cancellation, Trash restoration, version recovery, and working-set delivery.

Remaining limitations

• Accepted non-blocking follow-up: CR-027. kDrive acknowledges enabling comments but reports them disabled. The cause is unresolved; official-client comparison or vendor clarification can follow this PR. The strict assertion and truthful UI warning remain.
• Permanent deletion remains untested in the selected live suites. CR-013 remains open: the server exposes no documented conditional permanent-delete guarantee. Disposable-file success would not close that race. No full sixteen-scenario acceptance is claimed.
• Existing reconciliation gaps, unconditional service mutation ordering, large materialized-set performance limits, and encrypted-vault release gates remain documented in the safety register. This PR does not claim those guarantees are resolved.

Live execution stays serial, explicitly opt-in, and confined to a verified disposable lab below Private, using the existing Keychain login. Credentials and private live data are excluded from commits and ordinary exports.

See doc/CONFLICT_TESTING.md for commands and OS-specific validation, doc/CONFLICT_RESOLUTION_TRUTH_TABLE.md for policy and open risks, doc/STABILITY_LOOP_AUDIT.md for current run IDs and retained evidence, and doc/SHARE_SETTINGS_REPRODUCTION.md for the sanitized comments follow-up.