Enable hardened runtime resource access entitlements

[khoi]

Summary

• Enable hardened runtime resource access entitlements (audio, camera, contacts, calendars, location, photos, AppleScript) to match Ghostty's entitlement setup
• Programs running inside the Supacode terminal can now properly request TCC-protected resources through macOS permission dialogs

Closes #26

Context

Users raised concerns about macOS TCC permission popups for file system access (iCloud Drive, Documents, other app data). Investigation confirmed:

• These popups are standard behavior for all non-sandboxed terminal emulators (Ghostty, iTerm2, Alacritty, etc.) — macOS attributes child process file access to the parent app
• Supacode's own code only accesses ~/.supacode/ and user-selected repositories
• No file paths are sent to analytics (PostHog tracks event names only) or error tracking (Sentry logs operation names and exit codes only)
• The resource access entitlements were previously set to NO, unlike Ghostty which declares them — this PR aligns the configuration

Test plan

• Build the app and verify it launches without issues
• Run a terminal command that requests camera/microphone access and verify the TCC dialog appears correctly attributed to Supacode