v0.4.0

Upgrading: the Rekey startup daemon is renamed. Any older mariuzm.rekey or
dev.marius.rekey daemon is booted out and removed automatically the next time you
install or update the startup daemon — or via Remove in the Rekey pane.

Builds are signed with a local certificate when one is present, so Accessibility and Full
Disk Access grants survive a rebuild. make build still works with no setup anywhere — it
falls back to ad-hoc signing and warns that grants must be re-granted after each rebuild.
See Signing.

Added

• Dock Folders: clicking a checked folder in the Dock opens a custom browsable list instead of the
  macOS stack, so items inside can be right-clicked (Open in Terminal / Ghostty / VS Code, Reveal
  in Finder, Copy Path). Backed by a new background helper, macOS Utility Helper.
• Menu bar folder browser for pinned folders.
• Test suite (make test) covering path-safety rules, shell/AppleScript escaping, and saved-data
  migration.
• make tcc resets the app's and helper's Accessibility grants.

Changed

• App and helper are now signed with a stable local certificate instead of ad-hoc, so Accessibility
  and Full Disk Access grants survive a rebuild. Set SIGN_ID to override; defaults to the local
  macOS Utility Dev identity.
• Version and build numbers are injected from the Makefile at build time rather than duplicated in
  the plists.
• The Rekey startup daemon is now dev.marius.macosutility.rekey.plist. Older mariuzm.rekey and
  dev.marius.rekey daemons are booted out and removed automatically on install, or via the
  "Remove" button in the Rekey pane.
• Saved key mappings persist by HID usage rather than by display name, so renaming a key label no
  longer orphans existing mappings.
• Code layout: helper-only and app-only code moved out of the shared FolderKit library, which now
  holds only genuinely shared configuration and storage.

Fixed

• Cancelling the administrator password prompt was reported as "everything failed" — osascript
  writes its cancellation to stderr, which was never captured.
• The count of removed items was derived from shell exit codes that rm -rf does not set on
  failure; removal is now verified per path.
• Paths containing apostrophes were corrupted in the failure list.
• A corrupt pinned-folders file caused the defaults to immediately overwrite it, losing the user's
  folders. Missing and unreadable files are now distinguished.
• hidutil output larger than the pipe buffer could deadlock the app on the main thread.
• Cancelling a scan no longer repopulates the list seconds later; cancelling a delete no longer
  starts a new scan; a failed backup no longer opens Finder on an empty folder.
• Spotlight privacy reads no longer stage a script in a writable temp directory before running it
  as root.
• Relative or empty paths could resolve against the working directory and bypass the protected-root
  guard.
• Backup and delete failures now report the underlying reason instead of only a count.
• An unreadable folder in the popover showed "Empty folder" rather than a permissions message.
• The Dock panel's trust-polling timer could run for the process lifetime after overrides were
  removed; the event tap is now torn down on deallocation.