fix(settings): write the execution audit log through the app's storage environment

[datlechin]

Fixes #2242.

ExecutionAuditLog.defaultFileURL() asked FileManager for Application Support directly instead of going through AppStorageEnvironment.shared, which is the one type allowed to resolve that directory.

Two things follow from that, and both are fixed here.

swiftlint --strict failed on main. The repo's own storage_environment_directory rule is severity: error, so the mandatory lint step was red for everyone on a violation they did not write. A gate that is always red teaches people to ignore it.

UI tests wrote to the developer's own audit log. TableProUITests launches the real app against a sandbox named in TABLEPRO_UI_TEST_SANDBOX, and every other store honours it. This path did not, so a test run appended to the log of whoever ran it. The log is hash chained, so those entries are not noise: they are indistinguishable from real decisions and they advance the chain.

The change

defaultFileURL() now reads AppStorageEnvironment.shared.supportDirectory. It also drops to a non-optional URL: the old signature returned URL? only because FileManager.url(for:create:) could throw, and the environment cannot fail to name a root. That removes two unreachable guard let fileURL unwraps in load() and persist().

The production path is unchanged, byte for byte. AppStorageEnvironment.productionRoot() resolves the same directory the old call did, so there is no migration and no existing log moves.

Verification

• swiftlint --strict over the whole app target: exit 0, no output. It reports this exact violation on the unfixed tree, so that is a clean A/B.
• Debug build: PASS.
• ExecutionAuditRecordTests, ExecutionAuditLogTests, AppStorageEnvironmentTests: 20 executed, 20 passed. Log grepped for Failing tests: and TEST FAILED, 0 hits.

Test added

defaultLocationFollowsStorageEnvironment asserts the log resolves inside AppStorageEnvironment.shared.supportDirectory. It is a narrow guard and the lint rule remains the primary one: this test catches a future relocation outside the sandboxed root, the lint rule catches a return to resolving the directory by hand.

No CHANGELOG entry

Deliberate. CLAUDE.md asks for one-line user-facing entries, and this has no user-visible effect: same path, same contents, same behaviour. The bug only reaches someone running the test suite.

Noted, not fixed here

AppStorageEnvironment.supportDirectory had zero readers before this commit. Fifteen storage classes hand-append "TablePro" to applicationSupportRoot instead, which is the duplication that property exists to remove. Mechanical to fix, but it touches fifteen files that other branches are editing, so it does not belong in a bug fix.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.