SecureTest v1.3.2

What changed

• Secure sessions no longer end themselves at 10 minutes. A development-only timer was live in the shipped app and ended every real session 600 s after it began, then left the test on screen with a "Stay here" button. Release builds no longer arm it; the teacher's time limit and the student's hand-in are what end a session.
• The test is on screen only while the Mac is locked. After any session end other than a hand-in (End secure session, Cmd-E, time limit, an interruption) the app returns to "Your tests" by itself and tells the student; "Stay here" is gone. A session that fails to start, or never answers, shows "Couldn't start a secure session" instead of rendering the test unlocked. Whatever was being typed is saved before the screen changes.
• Development switches are ignored in the shipped app. Simulated lockdown, the no-fullscreen and debug-crash switches, --token, File → Open Test Bundle… and --bundle exist only in Debug builds. A build without the assessment entitlement refuses to start a session rather than running unlocked. The configuration profile's ServerURL / GoogleClientID now outrank a launch argument or environment variable.
• Sources beside the question. On a stimulus set shown "On its own page", a wide window now offers the same "Sources: Beside | Above" choice that side-by-side sets had; "Above" remains the default.

Requires configuration profile

A pkg alone is not a working install. Scope a com.apple.ManagedClient.preferences configuration profile to the same Macs as the pkg policy — the profile already deployed for v1.3.0 works unchanged. Skeleton: client/config-profile.example.mobileconfig; details in client/RELEASING.md "Configuration profile".

Preference domain	Key	Type	Value
net.psd401.securetest.client	ServerURL	string	the design-tool origin, https://<origin>
net.psd401.securetest.client	GoogleClientID	string	the native (macOS-type) Google OAuth client id, <native-google-client-id>

Requires macOS 26.4 or later. Built from fa39945.