Finalize Drawer iOS release candidate

[Bbrizly]

Summary

Finalizes the native iPhone companion without changing Drawer's product identity. The iOS app stays small, tactile and task-first; the same user-selected Drawer.md used by the Mac app / Files / Obsidian remains canonical. No account, backend or second task database is introduced.

Canonical file correctness

• security-scoped Files bookmark + NSFileCoordinator boundary for local, iCloud and third-party Files providers
• iCloud stale/not-downloaded copies are never treated as canonical; Drawer requests the current revision before reading/writing
• unresolved iCloud conflicts fail closed
• replacement files are staged until a real current UTF-8 read succeeds; an existing source remains canonical throughout the switch
• staged grants survive relaunch and provider authentication/conflict recovery
• app/widget mutations use one-retry content CAS against fresh bytes
• move/delete Undo is armed only when Drawer can prove the post-write canonical bytes equal the bytes Drawer wrote, preventing a stale Undo from erasing a newer Obsidian/iCloud edit

iPhone experience

• one-screen Today surface with Carried, Today, routines, Upcoming and Backlog
• instant capture to Today / Tomorrow / Backlog with draft + destination restoration and canonical-write-first feedback
• tactile task rows with 44 pt completion control, Doing/Clear/Reopen swipe semantics, destructive threshold feedback and context actions
• native task editor for title + Focus duration + note using one atomic Markdown transaction
• title edits preserve custom duration hints and Drawer-owned recurrence metadata
• recurring task controls and routine session flow stay Markdown-native rather than introducing a habit database
• calm informational sync/recovery presentation instead of styling every provider message as a failure
• Hide Completed no longer leaves empty ghost sections

Focus / ambient iOS surfaces

• Focus persists from an absolute end date so backgrounding, sleep and process death do not lose time
• notification permission is requested only when Focus actually needs a completion alert
• Live Activity / Dynamic Island mirrors the persisted Focus session instead of owning timer truth
• pause, resume, finish, reset, restore and stale-session cleanup all reconcile ActivityKit from the same persisted source
• widgets are interactive through App Intents but remain fail-closed: canonical Markdown must change before widget truth changes
• Home/Lock Screen widgets protect task content with privacy-sensitive presentation and preserve the last-known-good snapshot on provider failures
• App Shortcuts support Add Task, Complete Task and Open Today

Tactile + accessibility polish

• semantic haptic grammar for persisted state changes and swipe thresholds; ordinary navigation/scrolling stays silent
• Reduce Motion support across primary animations
• frequent controls normalized toward comfortable 44×44 pt iPhone targets
• important fixed hero typography replaced with semantic rounded Dynamic Type styles
• accessibility-size layouts fall back cleanly with ViewThatFits
• visible + VoiceOver acknowledgement accompanies state-changing actions so success never depends on vibration alone

Privacy / App Store readiness

• app and widget each ship a privacy manifest
• no tracking and no collected-data declaration
• UserDefaults required reasons now explicitly include App Group sharing (1C8F.1) in addition to app-private preferences
• matching app/widget App Group entitlements
• Live Activities and drawer:// deep links are validated by CI
• 1024×1024 opaque App Store icon is validated by CI
• iOS/RELEASE.md gives App Review a zero-dependency Files-only setup plus the signed-device acceptance matrix

Product invariant

Drawer.md is always canonical. No widget cache, cloud placeholder, staged replacement, Focus timer, Live Activity, UI animation or Undo buffer is allowed to become a second source of truth.

Automated release gate

The exact PR head must pass:

• shared DrawerCore suite
• existing macOS Drawer Release package/signature regression
• plist / entitlement / privacy / App Group / deep-link / Live Activity / icon invariants
• Debug iPhone Simulator app + widget tests
• optimized unsigned iOS Release app + widget build

The workflow now also runs for relevant changes on main, so iOS release integrity remains protected after merge.

Hardware/account gate

Simulator CI cannot prove real Taptic Engine tuning, security-scoped File Provider behavior after reboot/lock, iCloud eviction/materialization timing, Dynamic Island/Lock Screen behavior, Apple provisioning, Organizer validation or processed TestFlight installation. Those checks are explicit—not hand-waved—in iOS/RELEASE.md and iOS/README.md.

This PR is mergeable only when the exact final head SHA is green. App Store submission remains separately gated by the signed-device/TestFlight matrix that requires Apple credentials and real hardware.