ci: classify CloudStorage root permission failures (TIN-1547)

[Jesssullivan]

Summary

• classify pre-requestDownload CloudStorage root EPERM as cloudstorage_root_permission_denied
• preserve the root-level evidence in failure-classification-input.log, including cloud-root-find.err and FileProvider system diagnostics
• add a rebuild_domain dispatch input for macos-postinstall-smoke.yml, wiring it to the existing --rebuild-domain host-app remove/re-add path
• refresh workflow regression assertions for the current rc binary-version and TLS posture handling

Evidence

• bash scripts/test-macos-postinstall-smoke.sh
• bash scripts/test-release-workflow-fileprovider.sh
• git diff --check
• python3 -m py_compile scripts/tcfs-smoke-endpoint-preflight.py scripts/test-tcfs-smoke-endpoint-preflight.py

Why

Post-#399 run 26090322317 no longer misclassified find stderr as enumeration. It now fails before remote index/requestDownload with persistent CloudStorage root EPERM and fileproviderd failed to start FPFS for domain evidence. This PR makes that failure first-class and exposes the stale-domain rebuild lever for the next rerun.

Claim boundary

This still does not prove production FileProvider hydration. It improves failure classification and provides the next diagnostic/proof path.