fix(permissions): clear stale TCC entries on upgrade and grant click

[quiet-node]

Summary

• Pre-v0.8.2 upgraders had no sidecar last_launched_version, so the existing tccutil reset path skipped them. Stale Accessibility/ScreenCapture entries (with the previous binary's csreq) lingered in System Settings, leaving users with a "granted" toggle that didn't actually work for the new build. should_reset_for_upgrade(None, _) now returns true so the cleanup also covers migrations from sidecar-less builds.
• New click-time path: Grant Accessibility / Open Screen Recording Settings now invoke reset_and_relaunch_for_grant, which clears the requested service's TCC entry and relaunches so tccd re-registers the new csreq cleanly. A persisted last_reset_for_version marker lets the click-time flow skip when the startup-time reset already cleaned for this version, keeping the typical upgrade UX at one auto-restart.
• Frontend: PermissionsStep mounts call consume_pending_grant_resume and auto-resume the right step on the post-restart launch, so the user does not have to click Grant again.

Test plan

• bun run test:all:coverage — full vitest + cargo --fail-under-lines 100 gate green.
• bun run validate-build — lint, format, typecheck, release bundle all clean.
• Local smoke test: poison ~/Library/Application Support/com.quietnode.thuki/updater_state.json with last_launched_version: "0.0.0", install worktree build over current /Applications/Thuki.app, launch. Observed: brief auto-relaunch (A's reset+restart), onboarding shows, click Grant Accessibility opens System Settings with no stale Thuki entry, polling registers the new csreq, toggle appears waiting.
• Once merged + released, verify the same flow against the signed DMG so we cover an end-to-end auto-update (not just a manual replace).