[codex] gate update checks and pointer persistence

[rogu3bear]

Summary

This PR adopts the current pointer-app tranche into a branch and makes the release story stricter instead of broader.

• documents the macOS cursor persistence research and keeps true system-wide replacement unsupported
• adds a least-permission cursor reapply supervisor for app activation and mouse activity resets
• adds Settings-gated update checks, with internet access disabled by default and required before contacting GitHub release metadata
• persists update-check consent and observed release metadata
• tightens release authority with release-source-state-check, so public release gates require a clean committed tree and a rebuilt app/DMG newer than the commit being certified
• updates North Star, requirements, runbook, README, local-first guardrails, UI contract checks, and tests

Why

Research showed NSCursor.set() and AppKit cursor rectangles are not a durable system-wide pointer replacement. Other apps can reset cursor state through their normal cursor-update behavior, so the least-permission path is a supervised reapply mechanism before any privileged helper or private API route.

Update checks are also a network action, so they now require explicit Settings consent and a user-initiated check.

Validation

• swift test --package-path apps/macos passed: 216 tests, 0 failures
• ./scripts/check-monorepo-references.sh && ./scripts/check-website-boundary.sh && ./scripts/check-distribution-boundary.sh && ./scripts/check-compatibility-boundary.sh && ./scripts/check-local-first.sh && ./scripts/check-app-ui-contract.sh passed
• git diff --check passed
• bash -n apps/macos/Scripts/release-source-state-check.sh apps/macos/Scripts/release-readiness.sh apps/macos/Scripts/north-star-audit.sh scripts/check-local-first.sh scripts/check-app-ui-contract.sh passed
• apps/macos/Scripts/release-source-state-check.sh --app apps/macos/.build/release/CursorDesigner.app --dmg apps/macos/CursorDesigner.dmg correctly fails after this commit because the existing signed artifact predates ead3856

Release Blocker

This PR intentionally does not mark the product mass-production ready. After merge, the signed DMG must be rebuilt, signed, notarized, stapled, release metadata updated if needed, and manual release evidence completed against that same Gatekeeper-accepted artifact before make north-star-audit can pass.