v0.1.2 — one-click install fixed end-to-end

v0.1.2 — one-click install actually works end-to-end

Two independent bugs blocked the one-click install; both are fixed.

1. Frozen sidecar couldn't find Chromium

playwright's own frozen-app code (_transport.py) does
env.setdefault("PLAYWRIGHT_BROWSERS_PATH", "0") whenever the sidecar process's
environment doesn't already have that var set — "0" means "look for browsers
next to the driver," which is empty in this PyInstaller onefile bundle. Neither
launch path (double-clicking the .app, or running the frozen binary from the
same shell that ran the curl | bash installer) actually had the var in-process:
GUI launches never inherit ~/.zshrc exports, and a piped installer's export
doesn't propagate to the parent shell it was invoked from.

Fix: the sidecar now pins PLAYWRIGHT_BROWSERS_PATH to the app-data cache path
itself, in-process, before Playwright ever spawns its driver — no reliance on
inherited shell env from here on.

2. The .app itself couldn't launch (Launchd job spawn failed)

Double-clicking (or open-ing) the installed app failed outright with
RBSRequestErrorDomain Code=5 / Launchd job spawn failed. Root cause: the
app's entitlements declared keychain-access-groups: com.infinia.automate-studio.vault,
which requires a provisioning profile for that App ID — one this personal Apple
Development certificate doesn't have. AMFI kills the process at exec whenever
that entitlement is present and unprovisioned, regardless of launch method
(GUI or direct exec).

The credential vault (sidecar/vault.py) shells out to /usr/bin/security for
generic-password items rather than linking Keychain Services directly — it never
actually used the shared access group. The entitlement was dead weight with a
fatal side effect. Removed.

Verified end-to-end on this build

• open "Infinia Automate Studio.app" → app launches, spawns the sidecar, Task
  API live on 127.0.0.1:8765.
• Sidecar accepts a task with PLAYWRIGHT_BROWSERS_PATH deliberately unset in
  the shell → Chromium launches, task reaches running.

Install (one command, no repo access)

curl -fsSL https://infinia-automation-studio.adid.dev/install.sh \
  | INFINIA_TF_BASE_URL=https://api.tf-staging.iamsaif.ai/v1 \
    INFINIA_TF_API_KEY=tf-your-key-here \
    bash