feat: establish architecture security foundation

[YishenTu]

Summary

Establishes the architecture and safety foundation for DarthScriptum by making Markdown source authority, document synchronization, recovery, local rendering, and editor resize behavior explicit and testable.

This is a foundation-scale change that reorganizes production code and tests around clear app, core, document, editor, workspace, and resources ownership boundaries.

What changed

Architecture and ownership

• reorganize source and test files by domain responsibility
• add scoped ownership guidance and an architecture guard with violation fixtures
• document dependency direction, persistence authority, recovery behavior, renderer trust boundaries, maintenance, and release checks
• isolate MarkdownEngine internal APIs behind one compatibility boundary

Source, synchronization, and recovery

• make MarkdownSourceBuffer the sole in-memory Markdown mutator with revision-checked edits, bounded undo/redo history, document metrics, and scalable line indexing
• replace synchronization policy with a pure reducer, typed effects, immutable evidence payloads, and lifetime/attachment/attempt tokens
• move blocking document and recovery I/O to a dedicated off-main execution boundary
• harden atomic file replacement with preimage validation, durable commit journals, uncertain-outcome reconciliation, and generation-checked recovery mutations
• serialize recovery startup, persistence, migration, discard, and reconciliation through one actor-owned FIFO
• preserve encoding, BOM, newline style, and final-newline behavior across file round trips
• integrate verified external reads, three-way merge handling, Save As attachment verification, and file-monitor lifecycle management
• require managed documents to prove durability before close while retaining native review for untitled documents and native multi-document quit behavior

Editor and local rendering

• update MarkdownEngine from 0.10.1 to 0.11.0 and add focused compatibility coverage
• confine Mermaid and MathJax to non-persistent local WebKit sessions with canonical bundle roots, deny-by-default CSPs, zero-network hostile tests, bounded inputs/outputs, timeouts, and process replacement
• stabilize the first visible source line and rendered content while resizing
• coordinate table restyling, centered rendered blocks, Mermaid viewport updates, wrapping gutters, and offscreen layout behavior

Verification and CI

• add an arm64 macOS GitHub Actions workflow using macOS 26 and Xcode 26.4
• build Debug and Release configurations and run the non-performance test suite in hosted CI
• add architecture, synchronization, recovery interruption, renderer security, cross-boundary, close/quit, resize, and performance coverage
• exclude scoped guidance files from Xcode target membership

Verification performed

• ./scripts/verify.sh
  • arm64 Debug build
  • arm64 Release build
  • arm64 non-performance test suite
  • arm64 Benchmark performance suite
• tests/architecture/run-tests.sh
• git diff --check origin/main...HEAD
• hosted verify GitHub Actions check

Review follow-ups addressed

• enforce Package.resolved in CI with Xcode resolved-file-only package flags instead of allowing automatic re-resolution
• invoke tests/architecture/run-tests.sh from both scripts/verify.sh and hosted CI so guard regressions fail automated verification

Non-goals

• signing, notarization, packaging, publication, and distribution automation
• replacing native AppKit document review or the native editor with a web-based editing surface