feat: ship Mac Pulse internet monitoring and v1.3.0 hardening

[xudaniel]

Summary

• add opt-in, low-frequency Apple networkQuality sampling with cached download, upload, latency, responsiveness, and measurement timestamps
• retain/export every health sample through additive SQLite migrations and show bilingual internet-speed history in Mac Pulse
• complete the CI matrix for both CLIs, shell suites, dashboard build/tests, and database migration coverage
• align the product on v1.3.0 and harden releases with reproducible archives, SHA-256 checksums, SPDX SBOMs, and GitHub attestations
• refresh the dashboard toolchain, remove the unnecessary schema-generator CLI, and enforce a zero moderate-or-higher npm audit baseline
• add contributor guidance, ownership, issue/PR templates, bilingual architecture docs, and a synthetic dashboard preview
• add Dependabot, CodeQL, dependency review, repository taxonomy, milestones, and security guidance

Safety and compatibility

• internet testing is disabled by default and rejects intervals below 30 minutes
• older heartbeat payloads remain valid; transient speed-test failures retain the last valid cache
• schema changes are additive and the migration test proves a pre-v1.3 sample remains readable
• the dashboard preview is deterministic synthetic data and contains no private telemetry

Validation

• Bash syntax and all shell suites passed
• dashboard lint, production build, 11 tests, and legacy-data migration passed
• release archive, SPDX SBOM, checksums, manifest, version alignment, and YAML parsing passed
• a clean npm ci --ignore-scripts build reports zero known npm vulnerabilities
• hosted GitHub checks are running; ShellCheck remains authoritative in CI because it is not installed locally

Story coverage

Implements #15, #16, #17, #18, #19, #20, and #21. Stories remain open until their merge/release-specific acceptance criteria are verified.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ba92e93682

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Paginate in the same order used to render history

When an outage queues more than MAX_REPLAY_PER_RUN samples, each recovery run inserts a batch of old observations followed by the current sample, so IDs no longer follow reportedAt. Sorting only the returned page by reportedAt while the SQL still paginates by ORDER BY id DESC means the initial page can include old replayed samples while omitting newer observations with lower IDs; the chart and transition detector can therefore show false gaps until enough additional pages are loaded. Order and cursor the query by reported_at plus id, rather than reordering each ID-based page afterward.

Useful? React with 👍 / 👎.