Add Xcode companion workspace model and macOS CI

[ORESoftware]

What changed

• add a Swift multi-root workspace projection for a native companion dashboard
• add confirmation-gated action previews with exact executable, argv, and cwd
• add Swift Testing coverage for stable package ordering, severity counts, and unsafe-action rejection
• run swift test and release builds on fixed macOS 15
• pin checkout by full commit SHA and disable persisted checkout credentials
• record the hardened workflow properties in machine-readable conformance metadata

Validation

Current review head: 9b9304fee2ff236fc59407ddd97cc2c01225a69d.

The implementation + immutable/fixed-runner workflow head immediately preceding the metadata-only conformance update passed CI run 31238409074. Current exact-head run 31239129386 is queued at last observation and has not reported a test failure.

Tracking

• Linear: DEN-2508
• Independent certification: zed-pkg-test/zed-pkg-e2e#112, pinned to this exact head
• Remaining native gates: SwiftUI companion app, XcodeKit extension, App Group cache/entitlements, clean Xcode-instance tests, signing/notarization

[linear-code]

DEN-2508

[ORESoftware]

Independent exact-head certification is green in zed-pkg-test/zed-pkg-e2e#112 / workflow run 31210197200. This PR head 654f96f9c1d3ee80afc3034a883cb9083caefe00 passed swift test and the release build on macOS there, in addition to repo-local CI 31209562414. Keeping this draft until review and the SwiftUI/XcodeKit, entitlement, signing, and clean-instance gates are completed.