Harden privileged filesystem deletion against TOCTOU attacks

[TinyFrontier]

Summary

• replace the mutable temporary path list and root xargs rm -rf flow with a dedicated SMAppService LaunchDaemon using NSXPC and Authorization Services
• bind every deletion request to the lstat identity captured during scanning and revalidate allowlists, owner, type, device, and inode inside the root helper
• perform descriptor-relative no-follow traversal and deletion with openat, fstatat, and unlinkat
• add a root-owned quarantine with a durable recovery journal, exact operation reconciliation, and interprocess filesystem-mutation coordination
• harden direct moves to Trash against symlink and rename races
• update Xcode packaging, CI, release validation, permission UX, and security regression coverage

Root cause

The previous administrator-cleaning path stored validated paths in a user-owned temporary file. Another process running as the same user could replace that file while the password prompt was open, after which a root shell consumed it without revalidation. Separately, pathname-based deletion re-resolved filesystem objects after scanning, allowing an entry to be replaced with a symlink or a different inode before removal.

Impact

Privileged deletion no longer consumes mutable user-owned path data. A request is accepted only for the exact filesystem identity scanned by PureMac, parent symlinks are rejected, leaf symlinks are unlinked without following their targets, and interrupted privileged mutations are recovered fail-closed.

Validation

• xcodebuild test: 42 tests passed, 0 failures
• unsigned universal Release build succeeded for arm64 and x86_64
• app and embedded helper both contain arm64 x86_64
• embedded LaunchDaemon plist passed plutil -lint
• git diff --check passed
• verified the old xargs / /bin/rm / temporary path-list mechanism is absent from application and helper sources

[TinyFrontier]

Superseded by upstream PR momenbasel#132.