feat(perry/system): #675 — App Group / cross-process shared storage

[proggeramlug]

Closes #675 (MVP — see follow-up matrix).

Summary

Three new perry/system entry points so widgets, share extensions, watchOS targets, etc. can share key/value data with the host app:

import { appGroupSet, appGroupGet, appGroupDelete } from "perry/system";

appGroupSet("sessionToken", "abc123");
const t = appGroupGet("sessionToken");  // "abc123" — "" if absent
appGroupDelete("sessionToken");

Without this, the only official way to wire a Perry app to a Perry-built widget extension was to hand-write a Rust+Swift bridge per project. The issue calls this out as a steep onboarding cliff that creates a forest of subtly-different forks across the ecosystem.

Cross-platform coverage

Platform	Status
macOS	Real impl — NSUserDefaults(suiteName:), default suite name "group.perryapp" overridable via PERRY_APP_GROUP env var
iOS	In-process HashMap MVP (API exercisable in dev/tests) + #675 follow-up warning
tvOS	Stub (tvOS user apps rarely share data cross-process)
watchOS	Stub + #675 follow-up
visionOS	Stub + #675 follow-up
Android	Stub + #675 follow-up (SharedPreferences via JNI)
Windows	Stub + #675 follow-up (%LOCALAPPDATA%-backed kv)
Linux/GTK4	Stub + #675 follow-up (XDG-backed kv)
WASM	Stub via dispatch table fallback
HarmonyOS	Stub auto-generated by perry-runtime/build.rs

Every stub funnels through perry_runtime::stub_diag::perry_stub_warn so first call per process per symbol prints a [perry] warning line naming the platform and the #675 tracker.

macOS implementation detail

NSUserDefaults initWithSuiteName: → setObject:forKey: / stringForKey: / removeObjectForKey: → synchronize. The suite name is read from the PERRY_APP_GROUP environment variable; defaults to "group.perryapp".

For dev builds without the application-groups entitlement, the suite still works — it just stores under ~/Library/Preferences/group.perryapp.plist instead of inside the shared App Group container. That makes the API usable in local iteration without setting up code-signing.

appGroupGet returns the empty string when the key is absent (per the issue's contract). NSString → UTF-8 bytes via UTF8String + lengthOfBytesUsingEncoding:NSUTF8StringEncoding (= 4).

Plumbing (mirrors #918 / #917 pattern)

• perry-api-manifest/src/entries.rs — three method rows.
• perry-dispatch/src/lib.rs — three MethodRow rows (set: [Str, Str] → Void, get: [Str] → Str, delete: [Str] → Void). WASM falls through to ui_method_to_runtime() — symbol mapping for free.
• Per-platform exports across all UI crates.
• perry-ui-test/src/lib.rs — three Feature rows.
• HarmonyOS auto-stubbed via perry-runtime/build.rs.

Smoke test

App({body}) + appGroupSet + appGroupGet + appGroupDelete against release perry compiles + links cleanly; symbol resolution verified end-to-end.

What's deferred (#675 follow-ups)

• writeBlob/readBlob — file-backed shared data the issue calls out (FileManager.containerURL on iOS, XDG on Linux, etc.).
• Real iOS / Android / Windows / Linux / visionOS impls.
• perry.toml [ios].app_group + [android].shared_prefs_name configuration plumbing — currently hardcoded to the PERRY_APP_GROUP env var on macOS.
• Entitlement merge into Perry's signing pipeline for App Group capability.

Notes

No Cargo.toml version bump, no CLAUDE.md touch, no CHANGELOG.md entry — maintainer folds those in at merge time.